CVE-2022-36039

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX files. A user opening a malicious DEX file could be affected by this vulnerability, allowing an attacker to execute code on the user's machine. A patch is available on the `dev` branch of the repository.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
rizinorg	rizin	<= 0.4.0

References

https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406Patch, Third Party Advisory
https://github.com/rizinorg/rizin/issues/2969Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pgThird Party Advisory
https://security.gentoo.org/glsa/202209-06Third Party Advisory
https://github.com/rizinorg/rizin/commit/1524f85211445e41506f98180f8f69f7bf115406Patch, Third Party Advisory
https://github.com/rizinorg/rizin/issues/2969Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-pr85-hv85-45pgThird Party Advisory
https://security.gentoo.org/glsa/202209-06Third Party Advisory

Timeline

Published: Sep 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-36047.8The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injecti CVE-2022-360407.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360417.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360427.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360437.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bob CVE-2022-360447.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds wri CVE-2022-360459.8NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instan CVE-2022-360465.3Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected b CVE-2022-360484.3Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embed CVE-2022-360497.5Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator t CVE-2022-36057.8The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection CVE-2022-360518.8ZITADEL combines the ease of Auth0 and the versatility of Keycloak.**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** f