CVE-2022-36086

CVE-2022-36086 is a critical out-of-bounds write vulnerability affecting the rust-osdev linked-list-allocator library, specifically versions prior to 0.10.2. It arises from insufficient size checks during heap initialization and extension, allowing metadata write operations to exceed allocated memory. This flaw impacts all initialization functions on Heap and LockedHeap types, as well as the Heap::extend method. With a CVSS score of 9.8 (CRITICAL), this vulnerability presents a severe risk, enabling unauthenticated attackers to achieve high confidentiality, integrity, and availability impacts (CWE-119, CWE-1284, CWE-787). The attack vector is network-based with low complexity, requiring no user interaction or privileges. Despite its critical severity, there is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness of this vulnerability.