CVE-2022-48468

21

FAUCET Score

CVE-2022-48468 describes an unsigned integer overflow vulnerability in protobuf-c versions prior to 1.4.1, specifically within the parse_required_member function. This flaw carries a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity, requiring low privileges, and potentially leading to a high impact on availability. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.4.1CPE matchmatch criteria	cpe:2.3:a:protobuf-c_project:protobuf-c::::::::

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

1.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.37%

Probability of exploitation in next 30 days

EPSS Percentile

29.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

This CVE's current EPSS score of 0.0037 is in the 85th percentile among its peer group of 15,937 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

github_advisorypatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: cbl2 protobuf-c 1.4.1-1 on CBL Mariner 2.0Fixed in: 1.4.1-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 x64Fixed in: 1.4.1-1

microsoftpatch availablevia msrc

Product: CBL Mariner 2.0 ARMFixed in: 1.4.1-1

microsoftpatch availablevia msrc

Product: CBL Mariner 1.0 x64Fixed in: 1.3.2-2

microsoftpatch availablevia msrc

Product: CBL Mariner 1.0 ARMFixed in: 1.3.2-2

microsoftpatch availablevia msrc

Product: 18426-16823Fixed in: 1.4.1-1

microsoftpatch availablevia msrc

Product: 18425-16820Fixed in: 1.3.2-2

microsoftpatch availablevia msrc

Product: cm1 protobuf-c 1.3.2-2 on CBL Mariner 1.0Fixed in: 1.3.2-2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: protobuf-c-0:1.3.0-8.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: protobuf-c-0:1.3.3-13.el9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: protobuf-c-0:1.3.0-8.el8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: protobuf-c-0:1.3.0-8.el8_6

Vendor Advisories (3)

microsoft2023-May/CVE-2022-48468

CVE-2022-48468

redhatCVE-2022-48468Moderate

protobuf-c: unsigned integer overflow in parse_required_member

microsoft2023-Apr/CVE-2022-48468Moderate

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

References

github.com / protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217

Patch

github.com / protobuf-c/protobuf-c/issues/499

Issue TrackingPatchThird Party Advisory

github.com / protobuf-c/protobuf-c/pull/513

PatchThird Party Advisory

github.com / protobuf-c/protobuf-c/releases/tag/v1.4.1

PatchRelease Notes

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EI4JZSHJXW7WOOTAQSV5SUCC5GE2GC2B

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/UGLZZYPOLI733DPETL444E3GY5KSS6LG

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/VNUEZZEPR2F6M67ANXLOPJX6AQL3TK4P