CVE-2022-3964 ffmpeg QuickTime RPZA Video Encoder rpzaenc.c out-of-bounds

Medium 4.3 Published 13 Nov 2022 Updated 3 Aug 2024

A remote attacker can trigger an out-of-bounds read in the QuickTime RPZA Video Encoder, potentially causing a crash or leaking memory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-3964?

CVE-2022-3964 is a medium-severity memory corruption vulnerability in Ffmpeg Ffmpeg, published on 13 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.

Weakness: CWE-119

Which versions are affected by CVE-2022-3964?

It affects 1 product.

Linux distribution packages (6)

`ffmpeg-4` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`4.4-150400.3.5.1`
`ffmpeg-4` SUSE:Linux Enterprise Module for Package Hub 15 SP4	All versions	`4.4-150400.3.5.1`
`ffmpeg-4` SUSE:Linux Enterprise Workstation Extension 15 SP4	All versions	`4.4-150400.3.5.1`
`ffmpeg-4` openSUSE:Leap 15.4	All versions	`4.4-150400.3.5.1`
`ffmpeg-4` openSUSE:Tumbleweed	All versions	`4.4.3-2.1`
`ffmpeg-5` openSUSE:Tumbleweed	All versions	`5.1.2-4.1`

Products include Ffmpeg Ffmpeg.

How do I fix CVE-2022-3964?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-3964 being exploited?

There is no known exploitation of CVE-2022-3964 in the wild and no public exploit code.

All Ffmpeg Ffmpeg vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-3964, GHSA-5fpv-gjqp-q83p, JLSEC-2025-120, SUSE-SU-2022:4194-1, UBUNTU-CVE-2022-3964, openSUSE-SU-2024:12514-1 and 1 more.