What’s Vulnerable › Vulnerabilities

CVE-2022-39212: Last video frame is still sent after video is disabled in a call in Nextcloud Talk

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-17 · updated 2026-06-17
• Weakness: CWE-200

Description

Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame of any participant who has video disabled but a camera selected. It is recommended that the Nextcloud Talk app is upgraded to 13.0.8 or 14.0.4. Users unable to upgrade should select "None" as camera before joining the call.

Affected products

• Nextcloud Talk: before 13.0.8; from 14.0.0 before 14.0.4 — fixed in 13.0.8, 14.0.4

How to fix

Upgrade to a fixed version: Nextcloud Talk 13.0.8, 14.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wq3g-2x46-q2gv
• https://github.com/nextcloud/spreed/pull/7673
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wq3g-2x46-q2gv
• https://github.com/nextcloud/spreed/pull/7673

Get alerted when CVE-2022-39212 or the next vulnerability affects your stack