CVE-2022-36039: high-severity vulnerability in rizinorg rizin
Out-of-bounds write when parsing DEX files in Rizin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.4%
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. A patch is available on the `dev` branch of the repository.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
rizinorg · rizinRelated CVEs — rizinorg rizin
In the same product, most dangerous first.
CVE-2024-53256HIGHRizin has a command injection via RzBinInfo bclass due legacy codeEPSS 1.2%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.9%CVE-2022-36044HIGHRizin Out-of-bounds Write vulnerability in Lua binary pluginEPSS 0.4%CVE-2022-36041HIGHRizin Out-of-bounds Write vulnerability in Mach-O binary pluginEPSS 0.4%CVE-2022-36043HIGHRizin Double Free in bobj.c when using qnx binary pluginEPSS 0.4%CVE-2022-36040HIGHRizin Out-of-bounds Write vulnerability in pyc/marshal.cEPSS 0.4%