CVE-2022-36044

Rizin Out-of-bounds Write vulnerability in Lua binary plugin

High7.8EPSS 0.39%

Published: 6 Sept 2022
Updated: 23 Apr 2025
Reserved: 15 Jul 2022
Assigned by: GitHub_M

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.

Scores

CVSS scores of CVE-2022-36044, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.39% · top 67% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

CWE-787: Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

rizinorg · rizin
- affected <= 0.4.0

References (5)

https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q (opens in a new tab)x_transferred
https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd (opens in a new tab)x_transferred
https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 (opens in a new tab)x_transferred
GLSA-202209-06 (opens in a new tab)vendor-advisoryx_transferred
FEDORA-2023-af305bed3d (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-36044](https://trackcve.app/badge/CVE-2022-36044.svg)](https://trackcve.app/cve/CVE-2022-36044)

Record last updated 23 Apr 2025, 17:31 UTC.