# CVE-2022-38497: PYSEC-2022-277 - LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.

Source: https://junglewise.ai/threats/cve-2022-38497-lief-null-pointer-dereference-in-elf-corefile-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-38497 · Severity: low · CVSS 3.1 · Published 2022-09-13

LIEF is a library for parsing and manipulating executable file formats. A null pointer dereference in the ELF core file parsing component can cause the application to crash when processing malformed or specially crafted ELF files, leading to denial of service for any tool or service that uses LIEF to analyze binaries.

Technologies: [lief (PyPI)](https://junglewise.ai/threats/technologies/lief). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-38497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-38497 being exploited in the wild.

**How severe is CVE-2022-38497?** Low severity, with a CVSS score of 3.1, published 13 September 2022.

**Which products and versions are affected?** lief (PyPI) ECOSYSTEM:introduced=0,fixed=0.12.1, ECOSYSTEM:introduced=0,last_affected=0.12.1.

**Is there a fix for CVE-2022-38497?** Yes. lief (PyPI): upgrade to 0.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-38497 attacked?** It is attacked with local access.

**Am I affected by CVE-2022-38497?** Check whether you run lief (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lief (PyPI): upgrade to 0.12.1 or later

  ```sh
  pip install "lief>=0.12.1"
  ```


## Technical details

LIEF contains a null pointer dereference (CWE-476) in CoreFile.tcc:69 when parsing ELF core files. The vulnerability occurs during the assignment of a string object in the CoreFile::parse_() template function, triggered by malformed ELF headers or missing program headers. An attacker can trigger a segmentation fault by providing a specially crafted ELF binary file. The vulnerability is reachable via file input with no authentication required, but requires user interaction (loading the malicious file). A patch is available in commit ca938740264f1fcb18f91cba8e4039c518ecb75b.

## Affected products

- LIEF LIEF 0.8.0 through 0.12.1

## Identifiers

- CVE-2022-38497
- GHSA-2p5h-hpj4-fxgg
- PYSEC-2022-277

## Timeline

- 2022-09-14: disclosed
- 2022-09-20: patched: Fix available in commit ca938740264f1fcb18f91cba8e4039c518ecb75b

## References

- [https://github.com/lief-project/LIEF/issues/766](https://github.com/lief-project/LIEF/issues/766)

## Related threats

- [PYSEC-2026-1538 - LIEF is vulnerable to segmentation fault](https://junglewise.ai/threats/cve-2025-15504-lief-is-vulnerable-to-segmentation-fault)
- [LIEF uninitialized variable in machd_reader.c](https://junglewise.ai/threats/cve-2024-31636-lief-uninitialized-variable-in-machd-reader-c)
- [LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind](https://junglewise.ai/threats/cve-2022-43171-lief-heap-buffer-overflow-in-the-lief-macho-binaryparser-parse)
- [LIEF segmentation fault in MachO binary parser](https://junglewise.ai/threats/cve-2022-40922-lief-segmentation-fault-in-macho-binary-parser)
- [LIEF vulnerable to denial of service through segmentation fault](https://junglewise.ai/threats/cve-2022-40923-lief-vulnerable-to-denial-of-service-through-segmentation-fault)