CVE-2022-2294 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-08-25
A heap buffer overflow vulnerability in WebRTC allows a remote attacker to perform shellcode execution or cause heap corruption via a specially crafted HTML page. The vulnerability has been observed being exploited in the wild and affects various web browsers and operating systems utilizing the WebRTC library.
Quick answers
Is CVE-2022-2294 exploited in the wild?
Yes. CVE-2022-2294 is known to be exploited in the wild, first recorded on 25 August 2022. Treat it as urgent.
How severe is CVE-2022-2294?
Critical severity, with a CVSS score of 8.8, published 25 August 2022.
Which products and versions are affected?
WebRTC Project WebRTC; Google Chrome prior to 103.0.5060.114; Apple iPadOS up to (excluding) 15.6; Apple iPhone OS up to (excluding) 15.6.
Is there a fix for CVE-2022-2294?
A patch was published on 2022-07-04: Google Chrome version 103.0.5060.114 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2294 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-2294?
Check whether you run WebRTC. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
WebRTC Project WebRTC
Google Chrome prior to 103.0.5060.114
Apple iPadOS up to (excluding) 15.6
Apple iPhone OS up to (excluding) 15.6
Timeline
2022-07-04: patched: Google Chrome version 103.0.5060.114 released to address the vulnerability.
2022-08-25: disclosed: Vulnerability published and added to CISA Known Exploited Vulnerabilities catalog.
2022-08-25: kev added
2022-08-25: exploited: Reported as exploited in the wild.