CVE-2022-1238

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.0

7.6 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.85% chance of exploitation in the next 30 days, 56th percentile

Published

2022-04-06

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/47422cdf-aad2-4405-a6a1-6f63a3a93200

References

• CVE Record
• NVD entry

Related

• CVE-2022-1237
• CVE-2022-1239
• CVE-2022-1235
• CVE-2022-1240
• CVE-2022-1234
• CVE-2022-1241