VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 19, 2022· Updated Aug 3, 2024

CVE-2022-1921

CVE-2022-1921

Description

Integer overflow in GStreamer's avidemux element allows heap overwrite and potential arbitrary code execution when parsing crafted AVI files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in GStreamer's avidemux element allows heap overwrite and potential arbitrary code execution when parsing crafted AVI files.

Vulnerability

Integer overflow in the gst_avi_demux_invert function within the avidemux element of GStreamer [1]. This occurs while parsing AVI files, leading to a heap overwrite. Affected versions include GStreamer prior to the fix for this issue (likely versions before 1.20.3, but not explicitly stated). The code path is reachable when processing a specially crafted AVI file.

Exploitation

An attacker needs to deliver a malicious AVI file to the target. No authentication is required if the file is opened by a user or processed by an application using GStreamer. The attacker triggers the integer overflow, causing a heap overwrite. The exact sequence involves parsing the AVI file with the vulnerable function.

Impact

Successful exploitation could lead to arbitrary code execution due to heap corruption. The attacker gains the ability to execute code in the context of the application using GStreamer, potentially leading to full system compromise.

Mitigation

The fix was addressed in GStreamer's GitLab repository (issue #1224) [1]. Users should update to a patched version (e.g., GStreamer 1.20.3 or later, if applicable). If no patch is available, avoid processing untrusted AVI files. Not listed on CISA KEV as of this writing.

References
  1. gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1224

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.