Read the docs
TI-2022-01407 Aliases CVE-2022-1534GHSA-wmqx-7q2f-fcf6

Buffer Over-read at parse_rawml.c:1416 in bfabiszewski/libmobi

Priority LOW 31CWE-126Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.

Why it matters now

EPSS 0.00347 28th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed bfabiszewski/libmobi (bfabiszewski): 0.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
bfabiszewskibfabiszewski/libmobibefore 0.110.11Patch availableCNA
  • bfabiszewski/libmobi Vendorbfabiszewski Affected before 0.11 Fixed in 0.11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libmobi_project:libmobi:*:*:*:*:*:*:*:*before 0.11Vulnerablebfabiszewski
  • cpe:2.3:a:libmobi_project:libmobi:*:*:*:*:*:*:*:* Versions before 0.11 Vulnerable ·bfabiszewski

Remediation

  • Fix · CNA bfabiszewski/libmobi (bfabiszewski) Fixed in 0.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    bfabiszewski/libmobi 0.11

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-01406 Buffer Over-read in bfabiszewski/libmobiPriority LOW 34
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1534
  2. 2026-10-03 Alias added: GHSA-wmqx-7q2f-fcf6

References

Exploit 1

Patch 1

  • TI-2021-02684 Out-of-bounds Write in bfabiszewski/libmobi CVSS 3.1CRITICAL 9.8
  • TI-2021-02803 Out-of-bounds Read in bfabiszewski/libmobi CVSS 3.1CRITICAL 9.8
  • TI-2018-08389 The mobi_decode_font_resource function in util.c in Libmobi 0.3 allows remote attackers… CVSS 3.0HIGH 8.8
  • TI-2018-08164 The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers… CVSS 3.0HIGH 8.8
  • TI-2018-08387 The mobi_pk1_decrypt function in encryption.c in Libmobi 0.3 allows remote attackers to… CVSS 3.0HIGH 8.8
  • TI-2021-02806 Use of Out-of-range Pointer Offset in bfabiszewski/libmobi CVSS 3.1HIGH 8.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences