CVE-2022-3964

Name of the Vulnerable Software and Affected Versions ffmpeg (affected versions not specified)

Description A problematic vulnerability has been found in ffmpeg, affecting the component QuickTime RPZA Video Encoder in the file libavcodec/rpzaenc.c. The manipulation of the argument y size leads to an out-of-bounds read. This issue can be exploited remotely, potentially allowing an attacker to access confidential data and cause a denial of service.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. As a temporary workaround, consider restricting access to the vulnerable component QuickTime RPZA Video Encoder until a patch is applied. Avoid using the argument y size in the affected file libavcodec/rpzaenc.c to minimize the risk of exploitation.