Debian Linux
CVE-2022-1922
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 7.8, the real-world risk appears moderate based on multiple factors. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local access is required with user interaction needed to open a malicious file. The EPSS score of 0.06% (17th percentile) suggests very low probability of active exploitation in the wild. While a public proof-of-concept exists at the GitLab issue tracker, this is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed in-the-wild exploitation. The technical impact can range from denial of service (most common) to potential heap corruption (less likely on modern systems with mmap support), making this a medium-priority issue for most environments unless handling untrusted MKV files is a critical use case. |
| Exploit ScenarioDerived | An attacker could craft a malicious MKV file with specially designed zlib-compressed data that triggers an integer overflow when processed by vulnerable GStreamer versions. When a user opens this file in a media player or application using GStreamer, it would cause the application to crash or potentially corrupt heap memory. A proof-of-concept exploit demonstrating this attack is publicly available at the GitLab issue tracker, making it relatively straightforward for attackers to reproduce if they can deliver malicious files to targets. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An integer overflow vulnerability in GStreamer's Matroska demuxer can cause denial of service or potentially heap memory corruption when processing specially crafted MKV files with zlib-compressed data. The vulnerability affects GStreamer versions prior to the patched releases and requires local access with user interaction to exploit. A public proof-of-concept exploit is available, though the EPSS score indicates relatively low real-world exploitation likelihood at 0.06%.
RemediationAI
Apply the security updates provided by your distribution or upgrade GStreamer to a patched version. Debian users should install the updates referenced in DSA-5204 for Debian 11 or the LTS announcement for Debian 10. The upstream fix is tracked in GitLab issue 1225 at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225. As a temporary mitigation, avoid processing MKV files from untrusted sources, particularly those using zlib compression. Consider implementing file validation or sandboxing for applications that must process untrusted multimedia content.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the gst_matroska_decompress_data function within GStreamer's matroskademux element, which handles MKV (Matroska) multimedia container format files. According to the CPE data, this affects the GStreamer multimedia framework (cpe:2.3:a:gstreamer:gstreamer) as well as Debian Linux distributions 10.0 and 11.0. The root cause is an integer overflow (CWE-122: Heap-based Buffer Overflow) that occurs during zlib decompression operations. The impact varies based on the underlying libc implementation and operating system memory management capabilities - systems using mmap for large memory allocations will experience a segmentation fault, while systems without mmap support may suffer heap memory corruption.
Know when Debian Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
Executive ViewAI
CVE-2022-1922 presents notable security risk, a heap-based buffer overflow vulnerability rated CVSS 7.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
GitHub PoC
Exploit-DB