Security readout for executives and security teams
Plain-English summary
This CVE describes a memory leak in a development revision of GPAC. If triggered during media processing, the issue can consume memory and affect availability. The source data does not identify confidentiality or integrity impact, active exploitation, or a confirmed fixed version.
Executive priority
Treat this as a moderate availability risk. It matters most for services that automatically process customer or third-party media. Prioritize verification of GPAC usage first, then remediation if the cited development revision or affected derived code is present.
Technical view
CVE-2022-43254 is a CWE-401 memory leak in GPAC v2.1-DEV-rev368-gfd054169b-master, specifically associated with gf_list_new in utils/list.c. CVSS 3.1 is 5.5 with local attack vector, low complexity, no privileges, required user interaction, and high availability impact only.
Likely exposure
Exposure is most likely where the specified GPAC development revision, or code derived from it, processes user-supplied media. The affected-product metadata is incomplete, so teams should verify actual GPAC versions and downstream use rather than assuming all GPAC deployments are affected.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. CVSS indicates local attack vector and user interaction, suggesting the vulnerable condition depends on a user or workflow processing a crafted input, but no exploit details are provided.
Researcher notes
The public metadata is sparse: affected vendor/product fields are n/a, and the source bundle names only a GPAC development revision and component. Avoid broad product claims until GPAC issue 2284 or vendor guidance confirms affected and fixed ranges.
Mitigation direction
- Check GPAC issue 2284 and vendor guidance for fixed versions or recommended remediation.
- Upgrade away from the cited development revision when a vendor-supported fixed build is available.
- Restrict processing of untrusted media in workflows using affected GPAC code.
- Apply memory and process limits to reduce denial-of-service impact.
- Monitor GPAC-related jobs for abnormal memory growth or termination.
Validation and detection
- Inventory GPAC versions and identify any use of v2.1-DEV-rev368-gfd054169b-master.
- Review dependency manifests and containers for bundled or statically linked GPAC code.
- Confirm whether exposed workflows process user-supplied media files.
- Check operational logs for GPAC process memory exhaustion or availability failures.
- Track the referenced GitHub issue for remediation status and affected-version clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-43254 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/gpac/gpac/issues/2284CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.