CVE-2022-26981

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-13 · updated 2026-06-17
Weakness: CWE-120

Description

Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c).

Affected products

Apple iPadOS: before 15.6 — fixed in 15.6
Apple Iphone Os: before 15.6 — fixed in 15.6
Apple macOS: from 12.0 before 12.5 — fixed in 12.5
Apple tvOS: before 15.6 — fixed in 15.6
Apple watchOS: before 8.7 — fixed in 8.7
Fedoraproject Fedora: 36
liblouis: through 3.21.0

How to fix

Upgrade to a fixed version: Apple iPadOS 15.6; Apple Iphone Os 15.6; Apple macOS 12.5; Apple tvOS 15.6; Apple watchOS 8.7. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2022/Jul/12
http://seclists.org/fulldisclosure/2022/Jul/15
http://seclists.org/fulldisclosure/2022/Jul/16
http://seclists.org/fulldisclosure/2022/Jul/18
https://github.com/liblouis/liblouis/issues/1171
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFD2KIHESDUCNWTEW3USFB5GKTWT624L/
https://security.gentoo.org/glsa/202301-06
https://support.apple.com/kb/HT213340
https://support.apple.com/kb/HT213342
https://support.apple.com/kb/HT213345
https://support.apple.com/kb/HT213346
http://seclists.org/fulldisclosure/2022/Jul/12

Get alerted when CVE-2022-26981 or the next vulnerability affects your stack