PT-2022-26788 · Lief · Lief

Bladchan · Published 2022-11-17 · Updated 2025-04-29 · CVE-2022-43171

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions LIEF versions prior to 0.12.3

Description A heap buffer overflow in the parse dyldinfo generic bind function of LIEF's BinaryParser allows attackers to cause a Denial of Service (DoS) via a crafted MachO file.

Recommendations For versions prior to 0.12.3, update to version 0.12.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse dyldinfo generic bind function until a patch is available. Avoid processing untrusted or crafted MachO files with the affected LIEF versions.

Exploit

Fix

DoS

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

CVE-2022-43171

GHSA-JVP9-PHWP-P738

PYSEC-2022-43140

Affected Products

Lief

References · 8

• 🔥 https://github.com/lief-project/LIEF/issues/782 · Exploit
• https://osv.dev/vulnerability/GHSA-jvp9-phwp-p738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43171 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43171 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43140 · Vendor Advisory
• https://github.com/lief-project/LIEF · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2022-43140.yaml · Note
• https://t.me/cvenotify/120205 · Telegram Post