VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 19, 2022· Updated Aug 3, 2024

CVE-2022-2122

CVE-2022-2122

Description

Integer overflow in GStreamer's qtdemux_inflate function during zlib decompression can cause denial of service or potential heap overwrite.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in GStreamer's qtdemux_inflate function during zlib decompression can cause denial of service or potential heap overwrite.

Vulnerability

An integer overflow occurs in the qtdemux_inflate function of the qtdemux element in GStreamer when decompressing zlib-compressed data. This vulnerability can be triggered by processing a crafted QuickTime file. The overflow leads to a segfault or, depending on the libc and OS, a heap overwrite [1].

Exploitation

An attacker must supply a malicious QuickTime file with specially crafted compressed data. The user must open the file using an application that relies on GStreamer's qtdemux element, such as a media player. No additional privileges are required; the attack is remote via file delivery.

Impact

Successful exploitation results in denial of service (application crash due to segfault) or, under certain conditions, a heap overwrite that could potentially lead to arbitrary code execution. The actual impact depends on the libc implementation and operating system capabilities.

Mitigation

The issue was reported and a fix is available in the GStreamer git repository [1]. Users should update to a patched version of GStreamer. No specific fixed version is mentioned in the available references; consult the GStreamer project for the latest release containing the fix.

References
  1. gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

28

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

3

News mentions

0

No linked articles in our index yet.