What’s Vulnerable › Vulnerabilities
CVE-2022-29694
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-06-02 · updated 2026-06-17
- Weakness: CWE-476
Description
Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.
Affected products
- Unicorn-Engine Unicorn Engine: before 2.0.0; 2.0.0, 2.0.0-rc1, 2.0.0-rc2, 2.0.0-rc3, 2.0.0-rc4, 2.0.0-rc5 (+1) — fixed in 2.0.0
How to fix
Upgrade to a fixed version: Unicorn-Engine Unicorn Engine 2.0.0. Check the vendor advisory for mitigations.
References
- https://github.com/unicorn-engine/unicorn/commit/3d3deac5e6d38602b689c4fef5dac004f07a2e63
- https://github.com/unicorn-engine/unicorn/issues/1588
- https://github.com/unicorn-engine/unicorn/pull/1593/commits/31389e59457f304be3809f9679f91a42daa7ebaa
- https://github.com/unicorn-engine/unicorn/pull/1593/commits/6a879a082d4d67a5d13f1233ae0334cde0a7f844
- https://violentbinary.github.io/posts/2-simple-analysis-of-software-virtualization-of-memory-in-unicorn-engine/
- https://github.com/unicorn-engine/unicorn/commit/3d3deac5e6d38602b689c4fef5dac004f07a2e63
- https://github.com/unicorn-engine/unicorn/issues/1588
- https://github.com/unicorn-engine/unicorn/pull/1593/commits/31389e59457f304be3809f9679f91a42daa7ebaa
- https://github.com/unicorn-engine/unicorn/pull/1593/commits/6a879a082d4d67a5d13f1233ae0334cde0a7f844
- https://violentbinary.github.io/posts/2-simple-analysis-of-software-virtualization-of-memory-in-unicorn-engine/
Get alerted when CVE-2022-29694 or the next vulnerability affects your stack