CVE-2022-30055
Published: 16 May 2022
Summary
CVE-2022-30055 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Mersenne Prime95. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Prime95 version 30.7 build 9 contains a buffer overflow vulnerability, tracked as CVE-2022-30055 and assigned CWE-120, that can result in remote code execution. The flaw carries a CVSS 3.1 score of 9.8, reflecting a network-accessible attack vector that requires no authentication or user interaction.
An unauthenticated remote attacker can send specially crafted input to trigger the overflow and execute arbitrary code on the affected system. Public exploit code demonstrating the issue has been published on multiple sites.
The EPSS score for this CVE rose from lower values to a peak of 0.1764 on 2025-01-22 before receding to the current 0.0443, indicating a period of increased exploitation interest after disclosure. No official vendor advisories or patches appear among the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35269
Vulnerability details
Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.