CVE-2022-3109: Debian Linux

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 36 only
• Ffmpeg Ffmpeg: before 5.0.3 (fixed in 5.0.3)

Published 2022-12-16. Last modified 2026-06-17.