CVE-2022-36042highCWE-787

CVE-2022-36042: high-severity vulnerability in rizinorg rizin

Rizin Out-of-bounds Write vulnerability in dyld cache binary plugin

Published · Updated

Follow this CVE+ Monitor rizin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.4%
Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from dyld cache files. A user opening a malicious dyld cache file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 556ca2f9eef01ec0f4a76d1fbacfcf3a87a44810 contains a patch.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
rizinorg · rizin
Related CVEs — rizinorg rizin

In the same product, most dangerous first.

CVE-2024-53256HIGHRizin has a command injection via RzBinInfo bclass due legacy codeEPSS 1.2%CVE-2021-43814HIGHHeap-based OOB write when parsing dwarf DIE info in RizinEPSS 0.9%CVE-2022-36039HIGHOut-of-bounds write when parsing DEX files in RizinEPSS 0.4%CVE-2022-36044HIGHRizin Out-of-bounds Write vulnerability in Lua binary pluginEPSS 0.4%CVE-2022-36043HIGHRizin Double Free in bobj.c when using qnx binary pluginEPSS 0.4%CVE-2022-36041HIGHRizin Out-of-bounds Write vulnerability in Mach-O binary pluginEPSS 0.4%