CVE-2022-28884
HIGHCVSS 7.5/10EPSS 0.40%
Last modified
CVE-2022-28884 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Withsecure | Business Suite | All versions |
| Withsecure | Elements Endpoint Protection | All versions |
| F-Secure | Internet Gatekeeper | All versions |
| F-Secure | Linux Security | All versions |
References
- https://www.withsecure.com/en/expertise/peopleVendor Advisory
- https://www.withsecure.com/en/support/security-advisoriesVendor Advisory
- https://www.withsecure.com/en/expertise/peopleVendor Advisory
- https://www.withsecure.com/en/support/security-advisoriesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-28884?
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.
How severe is CVE-2022-28884?
CVE-2022-28884 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.
How do I fix CVE-2022-28884?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28879A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
- CVE-2022-2888If an attacker comes into the possession of a victim's OctoP…4.4
- CVE-2022-28880A Denial-of-Service vulnerability was discovered in the F-Se…7.5
- CVE-2022-28881A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
- CVE-2022-28882A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
- CVE-2022-28883A Denial-of-Service (DoS) vulnerability was discovered in F-…7.5
- CVE-2022-28885A Denial-of-Service (DoS) vulnerability was discovered in th…7.5
- CVE-2022-28886A Denial-of-Service vulnerability was discovered in the F-Se…5.5
- CVE-2022-28887Multiple Denial-of-Service (DoS) vulnerability was discovere…7.5
- CVE-2022-28888Spryker Commerce OS 1.4.2 allows Remote Command Execution.9.8
- CVE-2022-28889In Apache Druid 0.22.1 and earlier, the server did not set a…4.3
- CVE-2022-2889Use After Free in GitHub repository vim/vim prior to 9.0.022…7.8
Are you affected by CVE-2022-28884?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST