CVE-2022-3816

Axiomatic Bento4 mp4decrypt memory leak

Medium4.3EPSS 1.0%

Published: 1 Nov 2022
Updated: 15 Apr 2025
Reserved: 1 Nov 2022
Assigned by: VulDB

Description

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212682 is the identifier assigned to this vulnerability.

Scores

CVSS scores of CVE-2022-3816, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 1.0% · top 37% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-404 Denial of Service -> CWE-401 Memory Leak (opens in a new tab)All about CWE-404 and its CVEs

Affected products

Axiomatic · Bento4
- affected n/a

References (3)

https://github.com/axiomatic-systems/Bento4/issues/792 (opens in a new tab)x_transferred
https://github.com/axiomatic-systems/Bento4/files/9727059/POC_mp4decrypt_654515280.zip (opens in a new tab)x_transferred
https://vuldb.com/?id.212682 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-3816](https://trackcve.app/badge/CVE-2022-3816.svg)](https://trackcve.app/cve/CVE-2022-3816)

Record last updated 15 Apr 2025, 13:18 UTC.