QwikSec

Security Database

CVE

CWE

Training

CVE-2022-36044

Published: Sep 6, 2022

Modified: Apr 23, 2025

PUBLISHED

CVSS v3.1

7.8

HIGH

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting data from Luac files. A user opening a malicious Luac file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. Commits 07b43bc8aa1ffebd9b68d60624c9610cf7e460c7 and 05bbd147caccc60162d6fba9baaaf24befa281cd contain fixes for the issue.

Vendor	Product	Versions
rizinorg	rizin	affected `<= 0.4.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/rizinorg/rizin/security/advisories/GHSA-mqcj-82c6-gh5q

https://github.com/rizinorg/rizin/commit/05bbd147caccc60162d6fba9baaaf24befa281cd

https://github.com/rizinorg/rizin/commit/07b43bc8aa1ffebd9b68d60624c9610cf7e460c7

vendor-advisory

FEDORA-2023-af305bed3d

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.