7.5

CVE-2022-39046: gnu glibc

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2022-39046CGA-g5m9-q7jx-842qCGA-vqh8-923j-fx2c
Published 31-08-2022Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2022-39046 is a high (CVSS 7.5) vulnerability in gnu glibc. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.80%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-266F-8F55-CMM4CGA-7VJG-Q9W3-HGCC

Timeline

  1. 31-08-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.80%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.80% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (sourceware.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Netapp6 products
Chainguard1 product
  • glibc< 2.36-r1
Gnu1 product
Opensuse1 product
  • glibc&distro=openSUSE Tumbleweed< 2.36-3.1
Ubuntu1 product
  • glibc< 2.27-3ubuntu1.6 | < 2.31-0ubuntu9.9 | < 2.35-0ubuntu3.1
Wolfi1 product
  • glibc< 2.36-r1

6 vendors · 11 products

References

13 links
Show all 13 references