CVE-2022-28471: Rockcarry Ffjpeg

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

In ffjpeg (commit hash: caade60), the function bmp_load() in bmp.c contains an integer overflow vulnerability, which eventually results in the heap overflow in jfif_encode() in jfif.c. This is due to the incomplete patch for issue 38

Affected products

• Rockcarry Ffjpeg: version 2021-12-06 only

Published 2022-05-05. Last modified 2026-06-17.