CVE-2022-3662
Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free
CVE-2022-3662 is a high vulnerability (CVSS 7.3) in Axiomatic Bento4, published October 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. No source names a fixed version.
- Severity
- 7.3 HighCVSS 3.1, CVE List
- Exploit chance
- 0.89%EPSS, 59th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kodi-inputstream-adaptiveUbuntu:22.04:LTS | All versions, plus listed versions 2.6.14+ds1-12.6.23+ds1-119.0.0+ds1-119.0.0+ds1-2 | None known |
kodi-inputstream-adaptiveUbuntu:24.04:LTS | All versions, plus listed versions 20.3.11+ds-120.3.17+ds-420.3.18+ds-120.3.18+ds-1build1 | None known |
kodi-inputstream-adaptiveUbuntu:25.10 | All versions, plus listed versions 21.5.9+ds-1 | None known |
kodi-inputstream-adaptiveUbuntu:26.10 | All versions, plus listed versions 21.5.16+ds-1 | None known |
kodi-inputstream-adaptiveUbuntu:26.04:LTS | All versions, plus listed versions 21.5.9+ds-121.5.16+ds-1 | None known |
What each source reports
CVE List Score used
Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
CVE-2022-3662- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2022-43021
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
EUVD-2022-43021- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x5g9-53m7-6g25
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This...
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
GHSA-x5g9-53m7-6g25- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-416
- Updated
- 2026-11-02
NVD
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
CVE-2022-3662- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-416
- Updated
- 2026-11-02
OSV
Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
CVE-2022-3662- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-3662
A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.
- Record
UBUNTU-CVE-2022-3662- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/axiomatic-systems/Bento4/issues/802
vuldb.com?id.212002
nvd.nist.gov/vuln/detail/CVE-2022-3662
ubuntu.com/security/CVE-2022-3662
cve.org/CVERecord?id=CVE-2022-3662