Read the docs
TI-2022-06086 Aliases CVE-2022-21711

Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.

Priority MEDIUM 64CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00875 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed elfspirit (liyansong2018): 1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
liyansong2018elfspiritbefore 1.11.1Patch availableCNA
  • elfspirit Vendorliyansong2018 Affected before 1.1 Fixed in 1.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elfspirit_project:elfspirit:*:*:*:*:*:*:*:*before 1.1.0VulnerableElfspirit Project
  • cpe:2.3:a:elfspirit_project:elfspirit:*:*:*:*:*:*:*:* Versions before 1.1.0 Vulnerable ·Elfspirit Project

Remediation

  • Fix · CNA elfspirit (liyansong2018) Fixed in 1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-21711

References

Exploit 1

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences