Vulnerability Details : CVE-2022-2831
A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2022-2831
- cpe:2.3:a:blender:blender:3.3.0:alpha:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-2831
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-2831
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2022-2831
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: secalert@redhat.com (Secondary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-2831
-
https://developer.blender.org/rBb1329d7eaa52a11c73b75d19d20bd8f6d11ac535
rBb1329d7eaa52Patch;Vendor Advisory
-
https://developer.blender.org/rB32df09b2416a6961704eca0fe73534c8c4e715b2
rB32df09b2416aPatch;Vendor Advisory
-
https://developer.blender.org/T99705
⚓ T99705 Out-of-bounds memory access due to blender-thumbnailerExploit;Patch;Vendor Advisory
Jump to