TI-2022-03123 Aliases CVE-2022-3379 GHSA-q4w7-f882-h6hc

Out-of-bounds write in Horner Automation Cscape

LOW 36CWE-787Published 2022-10-27 · Updated 2025-04-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Horner Automation's Cscape version 9.90 SP7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by writing outside the memory buffer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00255 17th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Horner Automation	Cscape	up to 9.90	—	No fix listed	CNA

Cscape VendorHorner Automation Affected up to 9.90 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:a:hornerautomation:cscape::::::::	before 9.90	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:-::::::	9.90	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp1::::::	9.90 sp1	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp2::::::	9.90 sp2	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp3::::::	9.90 sp3	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp4::::::	9.90 sp4	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp5::::::	9.90 sp5	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp6::::::	9.90 sp6	Vulnerable	Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp7::::::	9.90 sp7	Vulnerable	Horner Automation

cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:* Versions before 9.90 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:-:*:*:*:*:*:* Versions 9.90 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp1:*:*:*:*:*:* Versions 9.90 sp1 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp2:*:*:*:*:*:* Versions 9.90 sp2 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp3:*:*:*:*:*:* Versions 9.90 sp3 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp4:*:*:*:*:*:* Versions 9.90 sp4 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp5:*:*:*:*:*:* Versions 9.90 sp5 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp6:*:*:*:*:*:* Versions 9.90 sp6 Vulnerable ·Horner Automation
cpe:2.3:a:hornerautomation:cscape:9.90:sp7:*:*:*:*:*:* Versions 9.90 sp7 Vulnerable ·Horner Automation

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-3379
2026-10-03 Alias added: GHSA-q4w7-f882-h6hc

References

Advisory 1

https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03

TI-2022-12696 Heap-based buffer overflow in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
TI-2022-11950 Out-of-bounds read in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
TI-2022-11334 Out-of-bounds write in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
TI-2022-10308 Out-of-bounds write in Horner Automation Cscape Csfont CVSS 3.1HIGH 7.8
TI-2019-10177 Out-of-bounds write in Horner Automation Cscape CVSS 3.1HIGH 7.8
TI-2019-10173 Improper input validation in Horner Automation Cscape CVSS 3.1HIGH 7.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences