Wiz
Vulnerability DatabaseCVE-2022-40438

CVE-2022-40438: 
NixOS vulnerability analysis and mitigation

Overview

Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file. The vulnerability was discovered and reported on September 7, 2022 (GitHub Issue).

Technical details

The vulnerability exists in the AP4_MemoryByteStream::WritePartial function within the Bento4 library's mp42aac component. When processing certain crafted files, the function attempts to perform a write operation of size 4294967288 bytes, leading to a heap-buffer-overflow. This was confirmed through testing with AddressSanitizer (ASAN) instrumentation. The CVSS v3.1 base score is 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) (NVD).

Impact

The successful exploitation of this vulnerability can lead to denial of service conditions in applications using the affected Bento4 library. The impact is primarily focused on availability, with no direct impact on confidentiality or integrity (NVD).

Mitigation and workarounds

Users should upgrade to a version newer than Bento4 v1.6.0-639. If upgrading is not immediately possible, users should exercise caution when processing untrusted input files through the mp42aac utility (GitHub Issue).

Additional resources

Source: This report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-69264CRITICAL9.8
  • JavaScriptJavaScript
  • pnpm
NoYesJan 07, 2026
CVE-2025-69263HIGH8.8
  • JavaScriptJavaScript
  • pnpm
NoYesJan 07, 2026
CVE-2025-69262HIGH7.8
  • JavaScriptJavaScript
  • pnpm
NoYesJan 07, 2026
CVE-2025-20807MEDIUM6.7
  • NixOSNixOS
  • android
NoNoJan 06, 2026
CVE-2026-21885MEDIUM6.5
  • NixOSNixOS
  • miniflux
NoYesJan 08, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo