CVE-2022-3219: gnupg Out-of-bounds Write
CVSS: 3.3v3.1LowModified
AliasesUBUNTU-CVE-2022-3219DEBIAN-CVE-2022-3219CGA-2546-fgvq-p537CGA-42r8-99rv-w7w6CGA-4ffr-q486-vffpCGA-5wcj-jcqc-prq4CGA-62f8-4wq7-57cgCGA-678c-vc88-3vfmCGA-68w7-xmcj-x6vrCGA-6xq7-xc94-89fjCGA-7gww-gqjj-mhj3CGA-7p5p-6367-cx33CGA-8v5m-g347-r9xhCGA-c2mm-qv28-84j7CGA-c4qq-3q2h-x946CGA-c64j-9767-2gxfCGA-cxq9-8jgf-c946CGA-hr95-q5w2-pwj6CGA-j9j2-cg44-hhwfCGA-jjmg-9vj5-f7g8CGA-jvv3-f5fv-p5rxCGA-jx78-2q7r-3pwwCGA-m25g-r5cp-3pp8CGA-mh4j-22cw-x7mrCGA-rrcv-8p4g-fh43CGA-vffq-6xp3-w24xCGA-w2mv-9grc-3xp7CGA-xpwc-hpg4-fc75
Published 23-02-2023Last modified 12-03-2025
Vulnerability summary
CVE-2022-3219 is a low (CVSS 3.3) Out-of-bounds Write vulnerability in gnupg. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities.
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 23-02-2023PublishedVulnerability first disclosed.
- 12-03-2025Last modifiedVulnerability information updated.
Description
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.
CVSS metrics
6 scores · 6 sources · 1 versionLow 3.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
0.00 pp
From 0.29% on 19-09-2026
19-09-202619-10-2026
EPSS score0.29%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- gnupgAll versions (No fix recorded)
- gnupg-dirmngrAll versions (No fix recorded)
- gnupg-docAll versions (No fix recorded)
- gnupg-gpgconfAll versions (No fix recorded)
- gnupg-langAll versions (No fix recorded)
Wolfi13 products
- gnupgAll versions (No fix recorded)
- gnupg-dirmngrAll versions (No fix recorded)
- gnupg-docAll versions (No fix recorded)
- gnupg-gpgconfAll versions (No fix recorded)
- gnupg-langAll versions (No fix recorded)
Ubuntu2 products
- gnupgAll versions (No fix recorded)
- gnupg2All versions (No fix recorded)
Debian1 product
- gnupg2All versions (No fix recorded)
Gnupg1 product
- gnupgna
5 vendors · 30 products
