CVE-2022-41916: Read one byte past a buffer when normalizing Unicode

Modified

AliasesALPINE-CVE-2022-41916UBUNTU-CVE-2022-41916USN-5766-1+1 more

Published 15-11-2022Last modified 23-04-2025

Vulnerability summary

CVE-2022-41916 is a high (CVSS 7.5) Off-by-one Error vulnerability in debian debian_linux. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

1.00%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DLA-3206-1 DSA-5287-1 MGASA-2022-0468 OPENSUSE-SU-2023:0019-1 OPENSUSE-SU-2023:0020-1

Timeline

15-11-2022
PublishedVulnerability first disclosed.
23-04-2025
Last modifiedVulnerability information updated.

Description

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

1.00%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 0.97% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian2 products

heimdal< 7.8.git20221115.a6cf945+dfsg-1
debian_linuxEOL10.0 | 11.0

Alpine1 product

heimdal< 7.7.1-r0

Heimdal1 product

heimdal< 7.7.1

Heimdal_project1 product

heimdal< 7.7.1

Ubuntu1 product

heimdal< 1.6~git20131207+dfsg-1ubuntu1.2+esm2 | < 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm2 | < 7.5.0+dfsg-1ubuntu0.2 | < 7.7.0+dfsg-1ubuntu1.2 | All versions (No fix recorded)

5 vendors · 6 products