CVE-2022-43171: LIEF heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind
Technical Details
Package Name
Ecosystem
Vulnerable Versions
First Patched Version
lief
pip
< 0.12.3
0.12.3
6.5
CVSS Score
3.1
6.5
CVSS Score
3.1
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability title and CVE description explicitly name parse_dyldinfo_generic_bind as the vulnerable function.
The GitHub issue (#782) provides ASAN traces showing a heap buffer overflow in this function at BinaryParser.tcc line 1629.
The crash occurs during segment command access via operator[] on a vector, indicating insufficient bounds checking when handling DYLD binding information.
The template specialization (MachO32) in the call stack confirms this is architecture-specific parsing code for Mach-O binaries.
No other functions are mentioned in the vulnerability reports or stack traces as contributing to this specific overflow.
Miggo AI