CVE-2022-2122

DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite.

• CWE-122
• CWE-190
• CWE-787

• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00001.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5204Third Party Advisory
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/08/msg00001.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2022/dsa-5204Third Party Advisory

Published

Jul 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21214The affected product is vulnerable to a heap-based buffer ov…7.8
• CVE-2022-21215This vulnerability could allow an attacker to force the serv…9.8
• CVE-2022-21216Insufficient granularity of access control in out-of-band ma…6.8
• CVE-2022-21217An out-of-bounds write vulnerability exists in the device Te…9.8
• CVE-2022-21218Uncaught exception in the Intel(R) Trace Analyzer and Collec…5.5
• CVE-2022-21219Out-of-bounds read vulnerability in CX-Programmer v9.76.1 an…7.8
• CVE-2022-21220Improper restriction of XML external entity for Intel(R) Qua…7.8
• CVE-2022-21221The package github.com/valyala/fasthttp before 1.34.0 are vu…7.5
• CVE-2022-21222The package css-what before 2.1.3 are vulnerable to Regular …7.5
• CVE-2022-21223The package cocoapods-downloader before 1.6.2 are vulnerable…9.8
• CVE-2022-21224Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-21225Improper neutralization in the Intel(R) Data Center Manager …8