Vulnerability-Lookup

CVE-2022-41409 (GCVE-0-2022-41409)

Vulnerability from cvelistv5 – Published: 2023-07-18 00:00 – Updated: 2024-10-28 18:22

Summary

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Severity

No CVSS data available.

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-28 18:22 UTC

CWE

Assigner

mitre mitre root

References

2 references

URL	Tags
https://github.com/PCRE2Project/pcre2/issues/141
https://github.com/PCRE2Project/pcre2/commit/94e1…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:42:46.199Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/PCRE2Project/pcre2/issues/141"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-41409",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-28T18:22:33.915896Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-28T18:22:42.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-18T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/PCRE2Project/pcre2/issues/141"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-41409",
    "datePublished": "2023-07-18T00:00:00.000Z",
    "dateReserved": "2022-09-26T00:00:00.000Z",
    "dateUpdated": "2024-10-28T18:22:42.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-41409",
      "date": "2026-09-16",
      "epss": "0.01121",
      "percentile": "0.6454"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.41\", \"matchCriteriaId\": \"BD82E860-EFC8-4692-8EE8-1514A9184D2B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.\"}]",
      "id": "CVE-2022-41409",
      "lastModified": "2024-11-21T07:23:10.577",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2023-07-18T14:15:12.197",
      "references": "[{\"url\": \"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/PCRE2Project/pcre2/issues/141\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/PCRE2Project/pcre2/issues/141\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-190\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2023-07-27T00:00:00.000Z",
      "cve": "CVE-2022-41409",
      "id": "msrc_CVE-2022-41409",
      "initial_release_date": "2023-07-01T07:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2022-41409.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-41409\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2023-07-18T14:15:12.197\",\"lastModified\":\"2026-06-17T05:03:09.637\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-28T18:22:33.915896Z\",\"id\":\"CVE-2022-41409\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.41\",\"matchCriteriaId\":\"BD82E860-EFC8-4692-8EE8-1514A9184D2B\"}]}]}],\"references\":[{\"url\":\"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/PCRE2Project/pcre2/issues/141\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/PCRE2Project/pcre2/issues/141\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T11:19:15+00:00",
      "cve": "CVE-2022-41409",
      "id": "CVE-2022-41409",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "18",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-41409.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:34:17Z",
      "cve": "CVE-2022-41409",
      "id": "CVE-2022-41409",
      "initial_release_date": "2023-07-21T02:25:47Z",
      "product_status:known_affected": "179",
      "product_status:known_not_affected": "474",
      "product_status:recommended": "420",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-41409",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-41409.json",
      "version": "51"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/PCRE2Project/pcre2/issues/141\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T12:42:46.199Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-41409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-28T18:22:33.915896Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-28T18:22:37.980Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://github.com/PCRE2Project/pcre2/issues/141\"}, {\"url\": \"https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2023-07-18T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-41409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-28T18:22:42.917Z\", \"dateReserved\": \"2022-09-26T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2023-07-18T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ubuntu-cve-2022-41409

Vulnerability from osv_ubuntu

Published

2023-07-18 14:15

Modified

2026-04-22 07:41

Summary

Details

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2022-41409	REPORT
	https://github.com/PCRE2Project/pcre2/issues/141	REPORT
	https://github.com/PCRE2Project/pcre2/commit/94e1…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-41409	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpcre2-16-0",
            "binary_version": "10.21-1"
          },
          {
            "binary_name": "libpcre2-32-0",
            "binary_version": "10.21-1"
          },
          {
            "binary_name": "libpcre2-8-0",
            "binary_version": "10.21-1"
          },
          {
            "binary_name": "libpcre2-posix0",
            "binary_version": "10.21-1"
          },
          {
            "binary_name": "pcre2-utils",
            "binary_version": "10.21-1"
          }
        ],
        "priority_reason": "No real security impact as this is a command-line utility that is not generally expected to handle untrusted input."
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "pcre2",
        "purl": "pkg:deb/ubuntu/pcre2@10.21-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.20-1",
        "10.20-2",
        "10.20-3",
        "10.21-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpcre2-16-0",
            "binary_version": "10.31-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpcre2-32-0",
            "binary_version": "10.31-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpcre2-8-0",
            "binary_version": "10.31-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libpcre2-posix0",
            "binary_version": "10.31-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "pcre2-utils",
            "binary_version": "10.31-2ubuntu0.1~esm1"
          }
        ],
        "priority_reason": "No real security impact as this is a command-line utility that is not generally expected to handle untrusted input."
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "pcre2",
        "purl": "pkg:deb/ubuntu/pcre2@10.31-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.22-3",
        "10.22-4",
        "10.22-5",
        "10.22-6",
        "10.31-2",
        "10.31-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpcre2-16-0",
            "binary_version": "10.34-7ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-32-0",
            "binary_version": "10.34-7ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-8-0",
            "binary_version": "10.34-7ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-posix2",
            "binary_version": "10.34-7ubuntu0.1"
          },
          {
            "binary_name": "pcre2-utils",
            "binary_version": "10.34-7ubuntu0.1"
          }
        ],
        "priority_reason": "No real security impact as this is a command-line utility that is not generally expected to handle untrusted input."
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "pcre2",
        "purl": "pkg:deb/ubuntu/pcre2@10.34-7ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.32-5",
        "10.34-7",
        "10.34-7ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libpcre2-16-0",
            "binary_version": "10.39-3ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-32-0",
            "binary_version": "10.39-3ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-8-0",
            "binary_version": "10.39-3ubuntu0.1"
          },
          {
            "binary_name": "libpcre2-posix3",
            "binary_version": "10.39-3ubuntu0.1"
          },
          {
            "binary_name": "pcre2-utils",
            "binary_version": "10.39-3ubuntu0.1"
          }
        ],
        "priority_reason": "No real security impact as this is a command-line utility that is not generally expected to handle untrusted input."
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "pcre2",
        "purl": "pkg:deb/ubuntu/pcre2@10.39-3ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.37-0ubuntu2",
        "10.39-3",
        "10.39-3build1",
        "10.39-3ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.",
  "id": "UBUNTU-CVE-2022-41409",
  "modified": "2026-04-22T07:41:41Z",
  "published": "2023-07-18T14:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-41409"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/PCRE2Project/pcre2/issues/141"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-41409"
  ]
}

VDE-2026-088

Vulnerability from csaf_mettlertoledogmbh - Published: 2026-08-20 10:00 - Updated: 2026-09-10 10:00

Summary

METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

Scope

65 vulnerabilities in this advisory, including CVE-2022-41409.

CVE-2022-41409

An integer overflow vulnerability affecting the pcre2test utility in PCRE2 versions before 10.41. The issue occurs when processing negative repeat values in the pcre2test subject line, which can trigger an integer overflow condition leading to infinite looping and denial of service through resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 1 product Recommended: 1 product

Open the full advisory

WID-SEC-W-2023-1983

Vulnerability from csaf_certbund - Published: 2023-08-07 22:00 - Updated: 2024-02-05 23:00

Summary

PCRE (Perl Compatible Regular Expressions): Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2022-41409.

CVE-2022-41409

Es besteht eine Schwachstelle in PCRE (Perl Compatible Regular Expressions). Dieser Fehler besteht aufgrund eines Integer-Überlaufs in der Komponente pcre2test, der es ermöglicht, speziell gestaltete Daten an die Anwendung zu übermitteln. Ein Angreifer kann diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen.

Known affected: 2 products

Open the full advisory

WID-SEC-W-2023-2917

Vulnerability from csaf_certbund - Published: 2023-11-14 23:00 - Updated: 2025-09-03 22:00

Summary

Xerox FreeFlow Print Server: Mehrere Schwachstellen

Severity

Hoch

Scope

135 vulnerabilities in this advisory, including CVE-2022-41409.

CVE-2022-41409

Known affected: 7 products

Open the full advisory

WID-SEC-W-2023-3041

Vulnerability from csaf_certbund - Published: 2023-11-30 23:00 - Updated: 2026-02-03 23:00

Summary

GitLab: Mehrere Schwachstellen

Severity

Hoch

Scope

13 vulnerabilities in this advisory, including CVE-2022-41409.

CVE-2022-41409

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-41409 (GCVE-0-2022-41409)

ubuntu-cve-2022-41409

Vulnerability from osv_ubuntu

VDE-2026-088

WID-SEC-W-2023-1983

WID-SEC-W-2023-2917

WID-SEC-W-2023-3041

Tags

Sightings

Nomenclature

Related by attack behaviour