What is the CVSS score of CVE-2022-2122?

CVE-2022-2122 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Debian Linux are affected by CVE-2022-2122?

CVE-2022-2122 presents notable security risk, a heap-based buffer overflow vulnerability rated CVSS 7.8.

Is there a public PoC exploit available for CVE-2022-2122?

Yes, a public proof-of-concept exploit is available for CVE-2022-2122. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2022-2122?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Debian Linux CVE-2022-2122

HIGH

Heap-based Buffer Overflow (CWE-122)

2022-07-19 secalert@redhat.com

Buffer Overflow Debian Debian Linux Gstreamer

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

PoC Detected

Mar 17, 2026 - 15:52 vuln.today

Public exploit code

CVE Published

Jul 19, 2022 - 20:15 nvd

HIGH 7.8

DescriptionCVE.org

DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.

AnalysisAI

A critical integer overflow vulnerability in GStreamer's qtdemux element allows attackers to trigger denial of service or potentially execute arbitrary code through heap memory corruption. The vulnerability affects GStreamer versions prior to the patched releases and requires user interaction to process a malicious media file. A public proof-of-concept exploit is available, though the EPSS score indicates relatively low real-world exploitation probability at 0.06%.

Technical ContextAI

The vulnerability resides in the qtdemux_inflate function within GStreamer's QuickTime demultiplexer (qtdemux) element, which handles zlib decompression of media data. The issue is classified as CWE-122 (Heap-based Buffer Overflow), where an integer overflow during decompression calculations can lead to incorrect memory allocation sizes. GStreamer is a widely-used multimedia framework that processes various media formats, and the qtdemux element specifically handles QuickTime/MP4 container formats. The behavior varies depending on the underlying libc implementation and operating system capabilities, ranging from a simple segmentation fault to a potentially exploitable heap overwrite condition.

RemediationAI

Apply the security updates provided in Debian Security Advisory DSA-5204 (https://www.debian.org/security/2022/dsa-5204) for Debian 11, and the corresponding LTS announcement (https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html) for Debian 10. For other distributions, update GStreamer packages to versions that include the fix for issue #1225 as tracked at https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225. As a temporary mitigation, restrict processing of untrusted media files and implement input validation for QuickTime/MP4 files where possible. Consider sandboxing applications that process media files to limit the impact of potential exploitation.