{"id":"CVE-2022-2566","aliases":["DEBIAN-CVE-2022-2566","EUVD-2022-34819","GHSA-m864-5788-g574","openSUSE-SU-2024:12332-1"],"status":"published","title":"Heap-memory write in FFMPEG","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00813,"percentile":0.57256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-190","CWE-787"],"published":"2022-09-23T11:10:14Z","modified":"2026-11-06T10:46:24Z","fixes":[{"ecosystem":"Debian:12","package":"ffmpeg","fixed_in":["7:5.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ffmpeg","fixed_in":["7:5.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ffmpeg","fixed_in":["7:5.1.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-5","fixed_in":["5.1.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ffmpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:5.1.1-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ffmpeg-5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1.1"}]}]}],"products":[{"vendor":"ffmpeg","product":"ffmpeg"}],"references":[{"url":"https://github.com/FFmpeg/FFmpeg/commit/c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2566","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m864-5788-g574"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2566.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2566","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2566","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-2566","title":"Heap-memory write in FFMPEG","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-23T11:10:14.367Z","modified":"2025-04-21T13:49:02.102Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34819","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-23T11:10:14Z","modified":"2025-04-21T13:49:02Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-m864-5788-g574","title":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in ...","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc(). An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-25T00:00:26Z","modified":"2023-07-05T05:01:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-190","CWE-787"],"updated_at":"2026-11-02T14:54:41.037164Z"}],"nvd":[{"id":"CVE-2022-2566","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-23T12:15:10.103Z","modified":"2026-06-17T04:42:07.79Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-190"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"CVE-2022-2566","title":"Heap-memory write in FFMPEG","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-23T11:10:14.367Z","modified":"2026-11-07T13:18:00.57396928Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2022-2566","description":"A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loop and adds `sc-\u003ectts_data[i].count` to `sc-\u003esample_offsets_count`. This can lead to an integer overflow resulting in a small allocation with `av_calloc()`. An attacker can cause remote code execution via a malicious mp4 file. We recommend upgrading past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05","status":"published","published":"2022-09-23T12:15:10.103Z","modified":"2026-11-03T08:02:46.623161136Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"openSUSE-SU-2024:12332-1","title":"ffmpeg-5-5.1.1-1.1 on GA media","description":"These are all security issues fixed in the ffmpeg-5-5.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:32.537768Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}