Every CVE Search/ Get API key

CVE-2022-3341

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of...

5.3 MediumFix available

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.86%Unchanged since Jan 13, 2023
90%50%10%1%

What each source reports

NVD Score used 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
CVE-2022-3341
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
CVE List 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
CVE-2022-3341
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2022-42728 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
EUVD-2022-42728
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-wp84-qf9p-3vp8 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of...

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
GHSA-wp84-qf9p-3vp8
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
OSV 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
CVE-2022-3341
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-07
OSVDEBIAN-CVE-2022-3341 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
DEBIAN-CVE-2022-3341
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
Show 12 moreShow less
OSVJLSEC-2025-122 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in `decode_main_header()` function of...

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
JLSEC-2025-122
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1759 5.3

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.(CVE-2022-3341)

Record
OESA-2024-1759
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2024-1760 6.3

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.(CVE-2022-3341)

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.(CVE-2023-51798)

Record
OESA-2024-1760
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2024-1761 6.3

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.(CVE-2022-3341)

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.(CVE-2023-51798)

Record
OESA-2024-1761
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2024-1831 5.5

ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file.(CVE-2021-28429)

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.(CVE-2022-3341)

Record
OESA-2024-1831
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-3341 5.3

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Record
UBUNTU-CVE-2022-3341
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVMGASA-2023-0043 No score

Updated ffmpeg packages fix security vulnerability

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash. (CVE-2022-3341)

Record
MGASA-2023-0043
Updated
2026-11-02
OSVopenSUSE-SU-2024:12636-1 No score

ffmpeg-4-4.4.3-4.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.3-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12636-1
Updated
2026-11-02
OSVSUSE-SU-2023:0172-1 No score

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues:

  • CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream (bsc#1206778).
Record
SUSE-SU-2023:0172-1
Updated
2026-11-02
OSVSUSE-SU-2023:0206-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

  • CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream (bsc#1206778).
  • CVE-2019-13390: Fixed a potential crash when processing a crafted AVI stream (bsc#1140754).
Record
SUSE-SU-2023:0206-1
Updated
2026-11-02
OSVSUSE-SU-2023:2115-1 No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

  • CVE-2019-13390: Fixed a potential crash when processing a crafted AVI stream (bsc#1140754).
  • CVE-2022-3341: Fixed a potential crash when processing a crafted NUT stream (bsc#1206778).
  • CVE-2022-48434: Fixed use after free in libavcodec/pthread_frame.c (bsc#1209934).
Record
SUSE-SU-2023:2115-1
Updated
2026-11-02
OSVUSN-5958-1 No score

ffmpeg vulnerabilities

It was discovered that FFmpeg could be made to dereference a null pointer. An attacker could possibly use this to cause a denial of service via application crash. These issues only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-3109, CVE-2022-3341)

It was discovered that FFmpeg could be made to access an out-of-bounds frame by the Apple RPZA encoder. An attacker could possibly use this to cause a denial of service via application crash or access sensitive information. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3964)

It was discovered that FFmpeg could be made to access an out-of-bounds frame by the QuickTime encoder. An attacker could possibly use this to cause a denial of service via application crash or access sensitive information. This issue only affected Ubuntu 22.10. (CVE-2022-3965)

Record
USN-5958-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:12
 before 7:5.1-1
7:5.1-1
ffmpeg
Debian:13
 before 7:5.1-1
7:5.1-1
ffmpeg
Debian:14
 before 7:5.1-1
7:5.1-1
ffmpeg
Debian:10
From an advisory covering 2 CVEs
 before 7:4.1.11-0+deb10u1, plus listed versions
7:4.1.10-0+deb10u17:4.1.3-17:4.1.4-17:4.1.4-1~deb10u17:4.1.6-1~deb10u17:4.1.8-0+deb10u17:4.1.9-0+deb10u1
7:4.1.11-0+deb10u1
ffmpeg
Debian:11
From an advisory covering 2 CVEs
 before 7:4.3.6-0+deb11u1, plus listed versions
7:4.3.2-0+deb11u27:4.3.2-17:4.3.2-27:4.3.3-0+deb11u17:4.3.4-0+deb11u17:4.3.5-0+deb11u1
7:4.3.6-0+deb11u1
FFMPEG_jll
Julia
 before 6.1.1+0
6.1.1+0
FFplay_jll
Julia
 before 7.1.0+0
7.1.0+0
ffmpeg
Mageia:8
 before 4.3.5-1.2.mga8
4.3.5-1.2.mga8
ffmpeg
Mageia:8
 before 4.3.5-1.2.mga8.tainted
4.3.5-1.2.mga8.tainted
ffmpeg
openEuler:20.03-LTS-SP4
 before 4.2.4-7.oe2003sp4
4.2.4-7.oe2003sp4
Show 25 moreShow less
Affected packages
PackageAffectedFixed
ffmpeg
openEuler:22.03-LTS-SP1
From an advisory covering 2 CVEs
 before 4.2.4-8.oe2203sp1
4.2.4-8.oe2203sp1
ffmpeg
openEuler:22.03-LTS-SP3
From an advisory covering 2 CVEs
 before 4.2.4-8.oe2203sp3
4.2.4-8.oe2203sp3
ffmpeg
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 4.2.4-14.oe2203sp4
4.2.4-14.oe2203sp4
ffmpeg-4
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
 before 4.4-150400.3.11.1
4.4-150400.3.11.1
ffmpeg-4
SUSE:Linux Enterprise Module for Package Hub 15 SP4
 before 4.4-150400.3.11.1
4.4-150400.3.11.1
ffmpeg-4
SUSE:Linux Enterprise Workstation Extension 15 SP4
 before 4.4-150400.3.11.1
4.4-150400.3.11.1
ffmpeg-4
openSUSE:Leap 15.4
 before 4.4-150400.3.11.1
4.4-150400.3.11.1
ffmpeg
SUSE:Linux Enterprise Module for Desktop Applications 15 SP4
From an advisory covering 2 CVEs
 before 3.4.2-150200.11.25.1
3.4.2-150200.11.25.1
ffmpeg
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 2 CVEs
 before 3.4.2-150200.11.25.1
3.4.2-150200.11.25.1
ffmpeg
SUSE:Linux Enterprise Real Time 15 SP3
From an advisory covering 2 CVEs
 before 3.4.2-150200.11.25.1
3.4.2-150200.11.25.1
ffmpeg
SUSE:Linux Enterprise Workstation Extension 15 SP4
From an advisory covering 2 CVEs
 before 3.4.2-150200.11.25.1
3.4.2-150200.11.25.1
ffmpeg
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 3.4.2-150200.11.25.1
3.4.2-150200.11.25.1
ffmpeg
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-150000.4.53.2
3.4.2-150000.4.53.2
ffmpeg
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 3.4.2-150000.4.53.2
3.4.2-150000.4.53.2
ffmpeg
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 3 CVEs
 before 3.4.2-150000.4.53.2
3.4.2-150000.4.53.2
ffmpeg
SUSE:Enterprise Storage 6
From an advisory covering 3 CVEs
 before 3.4.2-150000.4.53.2
3.4.2-150000.4.53.2
ffmpeg
Ubuntu:Pro:16.04:LTS
 before 7:2.8.17-0ubuntu0.1+esm5, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 17 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm4
7:2.8.17-0ubuntu0.1+esm5
ffmpeg
Ubuntu:Pro:18.04:LTS
 before 7:3.4.11-0ubuntu0.1+esm1, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 9 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.1
7:3.4.11-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:20.04:LTS
 before 7:4.2.7-0ubuntu0.1+esm1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu17:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.1
7:4.2.7-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:22.04:LTS
 before 7:4.4.2-0ubuntu0.22.04.1+esm1, plus listed versions
7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu37:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.1
7:4.4.2-0ubuntu0.22.04.1+esm1
ffmpeg
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 7:2.8.17-0ubuntu0.1+esm5, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 17 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm4
7:2.8.17-0ubuntu0.1+esm5
ffmpeg
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 7:3.4.11-0ubuntu0.1+esm1, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 9 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.1
7:3.4.11-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 7:4.2.7-0ubuntu0.1+esm1, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu17:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.1
7:4.2.7-0ubuntu0.1+esm1
ffmpeg
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 7:4.4.2-0ubuntu0.22.04.1+esm1, plus listed versions
7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu37:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.1
7:4.4.2-0ubuntu0.22.04.1+esm1
ffmpeg-4
openSUSE:Tumbleweed
 before 4.4.3-4.1
4.4.3-4.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3341 is a medium vulnerability (CVSS 5.3) in Ffmpeg, published January 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in ffmpeg 7:5.1-1.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open