What’s Vulnerable › Vulnerabilities

CVE-2022-48468

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-13 · updated 2026-06-17
• Weakness: CWE-190

Description

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Affected products

• Protobuf-C Project Protobuf-C: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: Protobuf-C Project Protobuf-C 1.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217
• https://github.com/protobuf-c/protobuf-c/issues/499
• https://github.com/protobuf-c/protobuf-c/pull/513
• https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EI4JZSHJXW7WOOTAQSV5SUCC5GE2GC2B/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UGLZZYPOLI733DPETL444E3GY5KSS6LG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNUEZZEPR2F6M67ANXLOPJX6AQL3TK4P/
• https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217
• https://github.com/protobuf-c/protobuf-c/issues/499
• https://github.com/protobuf-c/protobuf-c/pull/513
• https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EI4JZSHJXW7WOOTAQSV5SUCC5GE2GC2B/

Get alerted when CVE-2022-48468 or the next vulnerability affects your stack