CVE-2022-36044

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-36044

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36044.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-36044

Aliases

GHSA-mqcj-82c6-gh5q

Published

2022-09-06T00:00:00Z

Modified

2026-04-11T23:41:59.584965Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Rizin Out-of-bounds Write vulnerability in Lua binary plugin

Details

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36044.json"
}

References

Affected packages

Git / github.com/rizinorg/rizin

Affected ranges

Type: GIT
Repo: https://github.com/rizinorg/rizin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

07b43bc8aa1ffebd9b68d60624c9610cf7e460c7

Database specific

vanir_signatures_modified

"2026-04-11T23:41:59Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36044.json"

vanir_signatures

[
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "9114179400956166026806490749080465910",
                "141647950716231033960712452470651352338",
                "203371619328472460951370656405742994406",
                "122122810315559685324249356524337327696"
            ]
        },
        "target": {
            "file": "librz/bin/bobj.c"
        },
        "source": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7",
        "signature_type": "Line",
        "id": "CVE-2022-36044-44a613b2",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "115585023725065363652681674793707175144",
                "273439764585809750213454451052162252740",
                "191292091907489063763726256326437448179",
                "138810595769389364588559812963404100011",
                "289620902878724183091272464250448600138",
                "319719830351657164735484270487854214342",
                "180255372665746641547268191931774641874",
                "14715478804584404206664639608337111236"
            ]
        },
        "target": {
            "file": "librz/bin/format/luac/luac_bin.c"
        },
        "source": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7",
        "signature_type": "Line",
        "id": "CVE-2022-36044-67f6ae31",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 2726.0,
            "function_hash": "305525324468473274269039272146284936516"
        },
        "target": {
            "function": "_luac_build_info",
            "file": "librz/bin/format/luac/luac_bin.c"
        },
        "source": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7",
        "signature_type": "Function",
        "id": "CVE-2022-36044-9a90e509",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 775.0,
            "function_hash": "146566167267951156637636190157137463324"
        },
        "target": {
            "function": "classes_from_symbols",
            "file": "librz/bin/bobj.c"
        },
        "source": "https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7",
        "signature_type": "Function",
        "id": "CVE-2022-36044-f9e4e8f1",
        "deprecated": false
    }
]