CVE-2022-3341 Null dereference in FFmpeg

Medium 5.3 Published 12 Jan 2023 Updated 8 Apr 2025

A null pointer dereference in FFmpeg's NUT demuxer allows attackers to cause a denial of service via crafted media files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3341?

CVE-2022-3341 is a medium-severity vulnerability in Debian Debian Linux, published on 12 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.

Weakness: CWE-476

Which versions are affected by CVE-2022-3341?

It affects 2 products.

Linux distribution packages (5)

`ffmpeg-4` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`4.4-150400.3.11.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`4.4-150400.3.11.1`
`ffmpeg-4` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`4.4-150400.3.11.1`
`ffmpeg-4` openSUSE:Leap 15.4	All versions	`4.4-150400.3.11.1`
`ffmpeg-4` openSUSE:Tumbleweed	All versions	`4.4.3-4.1`

Products include Debian Debian Linux, Ffmpeg Ffmpeg.

How do I fix CVE-2022-3341?

Apply the vendor's patch.

Is CVE-2022-3341 being exploited?

There is no known exploitation of CVE-2022-3341 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-3341, GHSA-wp84-qf9p-3vp8, JLSEC-2025-122, MGASA-2023-0043, OESA-2024-1759, SUSE-SU-2023:0172-1 and 2 more.