CVE-2022-3816

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212682 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
Axiomatic	Bento4	n/a

References

https://github.com/axiomatic-systems/Bento4/files/9727059/POC_mp4decrypt_654515280.zipExploit, Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/792Issue Tracking, Third Party Advisory
https://vuldb.com/?id.212682Third Party Advisory
https://github.com/axiomatic-systems/Bento4/files/9727059/POC_mp4decrypt_654515280.zipExploit, Third Party Advisory
https://github.com/axiomatic-systems/Bento4/issues/792Issue Tracking, Third Party Advisory
https://vuldb.com/?id.212682Third Party Advisory

Timeline

Published: Nov 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381617.5The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of th CVE-2022-381626.1Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an u CVE-2022-381633.5A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operat CVE-2022-381646.5A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing atta CVE-2022-381659.8Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbit CVE-2022-381667.5In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler c CVE-2022-381676.1The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.CVE-2022-381689.1Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attack CVE-2022-38176.5A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionality CVE-2022-381704.7In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag whi CVE-2022-381717.8Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processin CVE-2022-381726.1ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboar