CVE-2022-3109 Null dereference in FFmpeg

High 7.5 Published 16 Dec 2022 Updated 16 Apr 2025

A missing return value check in FFmpeg's VP3 decoder leads to a null pointer dereference, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3109?

CVE-2022-3109 is a high-severity vulnerability in Debian Debian Linux, published on 16 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.

Weakness: CWE-476

Which versions are affected by CVE-2022-3109?

It affects 3 products.

Linux distribution packages (10)

`ffmpeg` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`3.4.2-150200.11.20.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`4.4-150400.3.8.1`
`ffmpeg` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`3.4.2-150200.11.20.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`4.4-150400.3.8.1`
`ffmpeg` SUSE:Linux Enterprise Real Time 15 SP3	All versions	`3.4.2-150200.11.20.1`
`ffmpeg` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`3.4.2-150200.11.20.1`
`ffmpeg-4` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`4.4-150400.3.8.1`
`ffmpeg` openSUSE:Leap 15.4	All versions	`3.4.2-150200.11.20.1`
`ffmpeg-4` openSUSE:Leap 15.4	All versions	`4.4-150400.3.8.1`
`ffmpeg-4` openSUSE:Tumbleweed	All versions	`4.4.3-3.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Ffmpeg Ffmpeg.

How do I fix CVE-2022-3109?

Apply the vendor's patch.

Is CVE-2022-3109 being exploited?

There is no known exploitation of CVE-2022-3109 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-3109, GHSA-mjpp-wxm2-vx37, JLSEC-2025-121, MGASA-2023-0004, SUSE-SU-2023:0007-1, SUSE-SU-2023:0008-1 and 2 more.