VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 19, 2022· Updated Aug 3, 2024

CVE-2022-1923

CVE-2022-1923

Description

Integer overflow in GStreamer's matroskademux bzip decompression leads to DoS or potential heap overwrite.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in GStreamer's matroskademux bzip decompression leads to DoS or potential heap overwrite.

Vulnerability

An integer overflow vulnerability exists in the bzip decompression function within the matroskademux element of GStreamer. When processing a crafted Matroska file with bzip-compressed data, the decompression routine performs an incorrect size calculation, leading to a heap buffer overflow. The issue affects certain versions of GStreamer.

Exploitation

An attacker can exploit this vulnerability by providing a malicious Matroska file containing specially crafted bzip-compressed data. If a user opens this file using GStreamer-based media players, the vulnerable code path is triggered. No authentication or special privileges are required.

Impact

The impact depends on the libc and OS. If the libc uses mmap for large memory allocations, the overflow typically results in a segmentation fault (denial of service). However, if mmap is not used, the overflow can overwrite adjacent heap memory, potentially allowing arbitrary code execution.

Mitigation

Not yet disclosed in the available references. Users should monitor GStreamer updates for a fix.

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.