Read the docs
TI-2022-11495 Aliases CVE-2022-28874GHSA-jgvq-q2v6-99mj

Multiple Denial-of-Service (DoS) Vulnerabilities

Priority LOW 34CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause memory corruption and heap buffer overflow which eventually can crash the scanning engine. The exploit can be triggered remotely by an attacker.

Why it matters now

EPSS 0.0062 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
F-SecureF-Secure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit). F-Secure Linux Security 64. F-Secure Atlant. WithSecure Cloud Protection for Salesforce & WithSecure Collaboration ProtectionAll Version—No fix listedCNA
  • F-Secure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit). F-Secure Linux Security 64. F-Secure Atlant. WithSecure Cloud Protection for Salesforce & WithSecure Collaboration Protection VendorF-Secure Affected All Version Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:f-secure:atlant:*:*:*:*:*:*:*:*all versionsVulnerableF-Secure
cpe:2.3:a:f-secure:elements_endpoint_protection:*:*:*:*:*:*:*:*all versionsVulnerableF-Secure
cpe:2.3:a:f-secure:linux_security:*:*:*:*:*:*:*:*all versionsVulnerableF-Secure
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:withsecure:cloud_protection_for_salesforce:*:*:*:*:*:*:*:*all versionsVulnerableWithSecure
cpe:2.3:a:withsecure:elements_collaboration_protection:*:*:*:*:*:*:*:*all versionsVulnerableWithSecure
  • cpe:2.3:a:f-secure:atlant:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·F-Secure
  • cpe:2.3:a:f-secure:elements_endpoint_protection:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·F-Secure
  • cpe:2.3:a:f-secure:linux_security:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·F-Secure
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:withsecure:cloud_protection_for_salesforce:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·WithSecure
  • cpe:2.3:a:withsecure:elements_collaboration_protection:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·WithSecure

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28874
  2. 2026-10-03 Alias added: GHSA-jgvq-q2v6-99mj

References

Advisory 2

  • TI-2023-23465 Certain WithSecure products allow Denial of Service via the aepack archive unpack handler. CVSS 3.1HIGH 7.5
  • TI-2023-23463 Certain WithSecure products allow Denial of Service in the aeelf component. CVSS 3.1HIGH 7.5
  • TI-2023-23460 Certain WithSecure products allow Denial of Service (infinite loop). CVSS 3.1HIGH 7.5
  • TI-2023-23464 Certain WithSecure products allow Local privilege escalation via the lhz archive unpack… CVSS 3.1HIGH 7.8
  • TI-2023-26941 Certain WithSecure products allow a Denial of Service because there is an unpack handler… CVSS 3.1HIGH 7.5
  • TI-2023-23459 Certain WithSecure products allow Denial of Service via a fuzzed PE32 file. CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences