CVE-2022-4899CWE-400

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun

High · published March 31, 2023

CVSS v3.1
7.5
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01588 · 75.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-03-31T00:00Z
EPSS history
Timeline
  • 31 MAR 00:00Z
    A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun
    cvelistv5