QwikSec

Security Database

CVE

CWE

Training

CVE-2022-36041

Published: Sep 6, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mach-O files. A user opening a malicious Mach-O file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commit number 7323e64d68ecccfb0ed3ee480f704384c38676b2 contains a patch.

Vendor	Product	Versions
rizinorg	rizin	affected `<= 0.4.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/rizinorg/rizin/security/advisories/GHSA-2c7m-2f37-mr5m

https://github.com/rizinorg/rizin/issues/2956

https://github.com/rizinorg/rizin/commit/7323e64d68ecccfb0ed3ee480f704384c38676b2

vendor-advisory

FEDORA-2023-af305bed3d

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

CVE-2022-36041 | HIGH (7.8) - Security Vulnerability | QwikSec