Every CVE Search/ Get API key

CVE-2022-3965

ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds

4.3 MediumFix available

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.96%Up 0.1 points since Nov 13, 2022
90%50%10%1%

What each source reports

CVE List Score used 4.3

ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
CVE-2022-3965
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2022-43297 4.3

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
EUVD-2022-43297
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-pv63-r3vq-5qmc 8.1

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the...

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
GHSA-pv63-r3vq-5qmc
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
NVD 4.3

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
CVE-2022-3965
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2022-3965 8.1

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
ALPINE-CVE-2022-3965
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSV 4.3

ffmpeg QuickTime Graphics Video Encoder smcenc.c smc_encode_stream out-of-bounds

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
CVE-2022-3965
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-119
Updated
2026-11-06
OSVDEBIAN-CVE-2022-3965 8.1

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
DEBIAN-CVE-2022-3965
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2022-3965 4.3

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the component QuickTime Graphics Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. The attack can be initiated remotely. The name of the patch is 13c13109759090b7f7182480d075e13b36ed8edd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213544.

Record
UBUNTU-CVE-2022-3965
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUSN-5958-1 No score

ffmpeg vulnerabilities

It was discovered that FFmpeg could be made to dereference a null pointer. An attacker could possibly use this to cause a denial of service via application crash. These issues only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3109, CVE-2022-3341)

It was discovered that FFmpeg could be made to access an out-of-bounds frame by the Apple RPZA encoder. An attacker could possibly use this to cause a denial of service via application crash or access sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3964)

It was discovered that FFmpeg could be made to access an out-of-bounds frame by the QuickTime encoder. An attacker could possibly use this to cause a denial of service via application crash or access sensitive information. This issue only affected Ubuntu 22.10. (CVE-2022-3965)

Record
USN-5958-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Alpine:v3.17
 5.0 up to 5.1.2-r2
5.1.2-r2
ffmpeg
Alpine:v3.18
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.19
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.20
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.21
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.22
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.23
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Alpine:v3.24
 5.0 up to 6.0-r0
6.0-r0
ffmpeg
Debian:12
 before 7:5.1.3-1
7:5.1.3-1
ffmpeg
Debian:13
 before 7:5.1.3-1
7:5.1.3-1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
ffmpeg
Debian:14
 before 7:5.1.3-1
7:5.1.3-1
ffmpeg
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 7:2.8.17-0ubuntu0.1+esm5, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 17 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm4
7:2.8.17-0ubuntu0.1+esm5
ffmpeg
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 7:3.4.11-0ubuntu0.1+esm1, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 9 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.1
7:3.4.11-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 7:4.2.7-0ubuntu0.1+esm1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu17:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.1
7:4.2.7-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 7:4.4.2-0ubuntu0.22.04.1+esm1, plus listed versions
7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu37:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.1
7:4.4.2-0ubuntu0.22.04.1+esm1

History

History
RecordedChangedSources
affected, factsOSV
affected, aliases, referencesOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3965 is a medium vulnerability (CVSS 4.3) in Ffmpeg, published November 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in ffmpeg 5.1.2-r2.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open