CVE-2022-3341

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	FFmpeg	Fixed-in ffmpeg 5.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=2157054Issue Tracking, Patch, Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951ePatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00016.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2157054Issue Tracking, Patch, Third Party Advisory
https://github.com/FFmpeg/FFmpeg/commit/9cf652cef49d74afe3d454f27d49eb1a1394951ePatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/06/msg00016.htmlThird Party Advisory

Timeline

Published: Jan 12, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-33428.8The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLi CVE-2022-33433.5The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tr CVE-2022-33445.5A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a coop CVE-2022-33466.5DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-contr CVE-2022-33477.5DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-contr CVE-2022-33484.9Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a little bit more specific,CVE-2022-33496.8A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readupcasetable of the co CVE-2022-33504.8The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege us CVE-2022-33514.3An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15 CVE-2022-33527.8Use After Free in GitHub repository vim/vim prior to 9.0.0614.CVE-2022-33537.5A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the v CVE-2022-33547.5A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library