Cyber Resilience

CVE-2022-3515

CriticalPublic PoC

Published: 12 January 2023

Published
12 January 2023
Modified
08 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 37.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-3515 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Gnupg Gnupg. Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 37.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example,…

more

a malicious S/MIME attachment.

CWE(s)
CWE-190

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

gnupg
libksba
≤ 1.6.3
gpg4win
gpg4win
2.0.0 — 4.1.0
gnupg
vs-desktop
3.1.16 — 3.1.26
gnupg
gnupg
2.1.0 — 2.2.41 · 2.3.0 — 2.4.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References