Debian Linux
CVE-2022-1923
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 7.8, the real-world exploitation risk appears moderate to low based on multiple signals. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local access is required with user interaction needed to open a malicious file, limiting remote exploitation potential. The EPSS score of 0.04% (13th percentile) suggests very low likelihood of active exploitation in the wild. While proof-of-concept code exists on GitLab, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed exploitation campaigns. The technical impact varies significantly based on system configuration, with many modern systems experiencing only crashes rather than exploitable memory corruption. This appears to be a legitimate vulnerability requiring patching but not an immediate critical risk for most organizations. |
| Exploit ScenarioDerived | An attacker creates a malicious MKV video file with specially crafted bzip-compressed data that triggers an integer overflow when processed by GStreamer applications. When a user opens this file in a vulnerable media player or video editing application, the overflow causes either an immediate crash or, on systems without memory-mapped allocations, potential heap corruption that could lead to code execution. The attack requires convincing a user to open the malicious file locally, as remote exploitation is not possible according to the CVSS vector, and proof-of-concept code is publicly available on the GStreamer GitLab repository. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An integer overflow vulnerability in GStreamer's matroska demuxer can cause denial of service through segmentation faults or potentially allow heap memory corruption when processing malformed MKV files with bzip compression. The vulnerability affects GStreamer versions prior to patches released in 2022, with proof-of-concept exploits publicly available and an EPSS score of 0.04% indicating low but non-zero exploitation probability. While not currently in CISA's KEV catalog, the vulnerability requires only local access with user interaction to exploit, achieving high impact across confidentiality, integrity, and availability.
RemediationAI
Apply the security updates provided by your distribution immediately - Debian users should install the patches referenced in DSA-5204 (https://www.debian.org/security/2022/dsa-5204) and the LTS announcement (https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html). For systems that cannot be immediately patched, consider implementing application-level controls to prevent processing of untrusted MKV files or disable bzip decompression support in GStreamer if not required. Monitor the upstream GStreamer issue tracker at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225 for additional updates and verify successful patching by testing with the proof-of-concept if available in a controlled environment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the matroskademux element of GStreamer, a popular multimedia framework, specifically in the bzip decompression function used when parsing MKV (Matroska) container files. According to the CPE data, all versions of GStreamer (cpe:2.3:a:gstreamer:gstreamer:*) are affected, along with Debian Linux 10.0 and 11.0. The root cause is CWE-122 (Heap-based Buffer Overflow), where an integer overflow during memory reallocation can lead to writing beyond allocated heap boundaries. The security impact varies based on the libc implementation and operating system memory management capabilities - systems using mmap for large allocations will experience only denial of service, while others may suffer heap corruption.
Know when Debian Linux gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap overwrite.
Executive ViewAI
CVE-2022-1923 presents notable security risk, a heap-based buffer overflow vulnerability rated CVSS 7.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
GitHub PoC
Exploit-DB