CVE-2022-3964

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.

Database specific

{
    "cwe_ids": [
        "CWE-119"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3964.json"
}

References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type

GIT

Repo

https://git.ffmpeg.org/ffmpeg.git

Events

Introduced

c5079bf3bccd24bf8ed45ff47ff4071fd09e9fd8

Fixed

71fb6132637a2a430375c24afc381fff8b854fe7

Introduced

390d6853d0ef408007feb39c0040682c81c02751

Fixed

0e15444aceca0e78f99f3d67758eb79d11b86599

Introduced

b189550137155a622f88df6e64e72c2cca660854

Fixed

963937e408fc68b5925f938a253cfff1d506f784

Fixed

92f9b28ed84a77138105475beba16c146bdaf984

Database specific

Show details

{
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.4"
        },
        {
            "fixed": "4.4.4"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.0.3"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.3"
        }
    ]
}

Affected versions

n4.*

n4.4

n4.4-dev

n4.4.1

n4.4.2

n4.4.3

n5.*

n5.0

n5.0.1

n5.0.2

n5.1

n5.1-dev

n5.1.1

n5.1.2

n5.2-dev

Database specific

vanir_signatures_modified

"2026-08-17T05:26:16Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3964.json"

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 239.0,
            "function_hash": "47249378359500502645416739436580078160"
        },
        "id": "CVE-2022-3964-6e34fb37",
        "source": "https://git.ffmpeg.org/ffmpeg.git@92f9b28ed84a77138105475beba16c146bdaf984",
        "target": {
            "function": "update_block_in_prev_frame",
            "file": "libavcodec/rpzaenc.c"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "160444889147155956527430127641719250137",
                "195833077783003430340785761433874798542",
                "79807956395446790354431020018392365441",
                "333474591425567053512268413176648399069",
                "284327766352867069933307378714834540172",
                "201680550570595861875072208039512412294",
                "236458945829736107863031347491251514896",
                "120590851916447307202016930817248046860",
                "293525954809459221061515308996246303481",
                "142917094294796612582454599160696579250",
                "209721490762621888751352196898266966210",
                "257189654840901582600896608681888613778",
                "185810119975340596243278689889480260357",
                "34154403963463507451712561585253151122",
                "330291008305670536089142213509542818844",
                "97512010382036706109135410265119476430",
                "329567819115382917732544531272038680569",
                "141673519873073423818094902486574842977",
                "192647473679262518988669173114150422240",
                "319157671421347809916301912300779408430",
                "15202447629866321614150016087043353195",
                "261143075129215082369557415538055310627",
                "75463082375259282060348684292287770644",
                "155830116312675174246326259979065872852",
                "253275915605689067241813363767051462754",
                "144672935916080812219300816705973140506",
                "66949773762204867832048777372140116869"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-3964-b91629e8",
        "source": "https://git.ffmpeg.org/ffmpeg.git@92f9b28ed84a77138105475beba16c146bdaf984",
        "target": {
            "file": "libavcodec/rpzaenc.c"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3156.0,
            "function_hash": "212926784269123948933627411590351494385"
        },
        "id": "CVE-2022-3964-de8feb62",
        "source": "https://git.ffmpeg.org/ffmpeg.git@92f9b28ed84a77138105475beba16c146bdaf984",
        "target": {
            "function": "rpza_encode_stream",
            "file": "libavcodec/rpzaenc.c"
        }
    }
]

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type

GIT

Repo

https://github.com/ffmpeg/ffmpeg

Events

Introduced

c5079bf3bccd24bf8ed45ff47ff4071fd09e9fd8

Fixed

71fb6132637a2a430375c24afc381fff8b854fe7

Introduced

390d6853d0ef408007feb39c0040682c81c02751

Fixed

0e15444aceca0e78f99f3d67758eb79d11b86599

Introduced

b189550137155a622f88df6e64e72c2cca660854

Fixed

963937e408fc68b5925f938a253cfff1d506f784

Database specific

Show details

{
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "4.4"
        },
        {
            "fixed": "4.4.4"
        },
        {
            "introduced": "5.0"
        },
        {
            "fixed": "5.0.3"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.3"
        }
    ]
}

Affected versions

n4.*

n4.4

n4.4-dev

n4.4.1

n4.4.2

n4.4.3

n5.*

n5.0

n5.0.1

n5.0.2

n5.1

n5.1-dev

n5.1.1

n5.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3964.json"