CVE-2022-1441

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function `diST_box_read()` to read from video. In this function, it allocates a buffer `str` with fixed length. However, content read from `bs` is controllable by user, so is the length, which causes a buffer overflow.

• CWE-119
• CWE-125

• https://github.com/gpac/gpac/commit/3dbe11b37d65c8472faf0654410068e5500b3adbPatch, Third Party Advisory
• https://github.com/gpac/gpac/issues/2175Exploit, Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5411Third Party Advisory
• https://github.com/gpac/gpac/commit/3dbe11b37d65c8472faf0654410068e5500b3adbPatch, Third Party Advisory
• https://github.com/gpac/gpac/issues/2175Exploit, Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2023/dsa-5411Third Party Advisory

Published

Apr 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1435The WPCargo Track & Trace WordPress plugin before 6.9.5 does…4.8
• CVE-2022-1436The WPCargo Track & Trace WordPress plugin before 6.9.5 does…6.1
• CVE-2022-1437Heap-based Buffer Overflow in GitHub repository radareorg/ra…7.1
• CVE-2022-1438A flaw was found in Keycloak. Under specific circumstances, …4.8
• CVE-2022-1439Reflected XSS on demo.microweber.org/demo/module/ in GitHub …6.1
• CVE-2022-1440Command Injection vulnerability in git-interface@2.1.1 in Gi…9.8
• CVE-2022-1442The Metform WordPress plugin is vulnerable to sensitive info…7.5
• CVE-2022-1443Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2022-1444heap-use-after-free in GitHub repository radareorg/radare2 p…5.5
• CVE-2022-1445Stored Cross Site Scripting vulnerability in the checked_out…5.4
• CVE-2022-1451Out-of-bounds Read in r_bin_java_constant_value_attr_new fun…7.1
• CVE-2022-1452Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new …7.1