5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-3857

CVE-2022-3857: A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and...

A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2022-3857

CVE-2022-3857:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the vulnerability description and the detailed information from the SourceForge bug report #300, as no direct commit/patch information was provided. The vulnerability is a NULL Pointer Dereference (NPD) occurring in the png_setup_paeth_row function within pngwutil.c. This is explicitly stated in the CVE description and confirmed by the stack trace in the bug report, making it the primary vulnerable function where the flaw manifests. The function png_write_find_filter, also located in pngwutil.c, is identified as the direct caller of png_setup_paeth_row from the same stack trace. It is responsible for row filter selection and setup, including the Paeth filter. Therefore, png_write_find_filter processes the crafted PNG data in a manner that triggers the vulnerable condition in png_setup_paeth_row. Both functions would appear in a runtime profile during the exploitation of this vulnerability. The file paths are derived from the stack trace provided in the bug report.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.