CVE-2022-28331: Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
Apache Portable Runtime (APR) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the aprsocketsendv() function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
Other sources
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in aprsocketsendv(). This is a result of integer overflow.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28331?
The severity of CVE-2022-28331 is critical with a CVSS v3 score of 9.8.
Which software is affected by CVE-2022-28331?
The Apache Portable Runtime version 1.7.0 and earlier on Windows is affected by CVE-2022-28331.
How does CVE-2022-28331 impact Windows?
CVE-2022-28331 may allow an attacker to write beyond the end of a stack-based buffer in apr_socket_sendv() on Windows systems.
Are Microsoft Windows systems vulnerable to CVE-2022-28331?
No, Microsoft Windows systems are not vulnerable to CVE-2022-28331.
How can I fix CVE-2022-28331?
Update to Apache Portable Runtime version 1.7.1 or later to fix CVE-2022-28331.