CVE-2022-1427

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
mruby	mruby/mruby	>= unspecified, < 3.2

References

https://github.com/mruby/mruby/commit/a4d97934d51cb88954cc49161dc1d151f64afb6bPatch, Third Party Advisory
https://huntr.dev/bounties/23b6f0a9-64f5-421e-a55f-b5b7a671f301Exploit, Third Party Advisory
https://github.com/mruby/mruby/commit/a4d97934d51cb88954cc49161dc1d151f64afb6bPatch, Third Party Advisory
https://huntr.dev/bounties/23b6f0a9-64f5-421e-a55f-b5b7a671f301Exploit, Third Party Advisory

Timeline

Published: Apr 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14284.3An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta CVE-2022-14297.5SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data CVE-2022-14307.5Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.CVE-2022-14315.3An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14326.4Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.CVE-2022-14336.1An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.CVE-2022-14345.9The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially pre CVE-2022-14354.8The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege CVE-2022-14366.1The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting CVE-2022-14377.1Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end of the CVE-2022-14384.8A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-CVE-2022-14396.1Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript a