Is CVE-2023-40022 actively exploited?

CVE-2023-40022 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2023-40022?

CVE-2023-40022 has a CVSS score of 7.8 (HIGH severity). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

How do I patch CVE-2023-40022?

Patch guidance is available from rizin security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2023-40022.

Fix CVE-2023-40022 - HIGH rizin rizin

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in `consume_count` of `src/gnu_v2/cplus-dem.c`. The overflow check is valid logic but, is missing the modulus if the block once compiled. The compiler sees this block as unreachable code since the prior statement is multiplication by 10 and fails to consider overflow assuming the count will always be a multiple of 10. Rizin version 0.6.1 contains a fix for the issue. A temporary workaround would be disabling C++ demangling using the configuration option `bin.demangle=false`.

CVSS Metrics

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector: local
Complexity: low
Privileges: none
User Action: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-190 · Integer Overflow

Metadata

Primary Vendor: RIZIN
Published: 8/24/2023
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

rizin : rizin

Remediation Guidance

Executive Summary

Cite this page

CVE-2023-40022. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2023-40022

View on NIST NVD

CVE-2023-40022 vulnerability