CVE-2022-35928

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checked before being read. This vulnerability may lead to buffer overruns. This does _not_ affect source code found on aescrypt.com, nor is the vulnerability present when providing a password or a key via the `-p` or `-k` command-line options. The problem was fixed via in commit 68761851b and will be included in release 3.16. Users are advised to upgrade. Users unable to upgrade should us the `-p` or `-k` options to provide a password or key.

• CWE-120
• CWE-1284

• https://github.com/paulej/AESCrypt/commit/68761851b595e96c68c3f46bfc21167e72c6a22cPatch, Third Party Advisory
• https://github.com/paulej/AESCrypt/security/advisories/GHSA-r7fv-72pg-fwrqPatch, Third Party Advisory
• https://github.com/paulej/AESCrypt/commit/68761851b595e96c68c3f46bfc21167e72c6a22cPatch, Third Party Advisory
• https://github.com/paulej/AESCrypt/security/advisories/GHSA-r7fv-72pg-fwrqPatch, Third Party Advisory

Published

Aug 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35922Rust-WebSocket is a WebSocket (RFC6455) library written in R…7.5
• CVE-2022-35923v8n is a javascript validation library. Versions of v8n prio…7.5
• CVE-2022-35924NextAuth.js is a complete open source authentication solutio…9.1
• CVE-2022-35925BookWyrm is a social network for tracking reading. Versions …9.8
• CVE-2022-35926Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2022-35927Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2022-35929cosign is a container signing and verification utility. In v…9.8
• CVE-2022-3593Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35930PolicyController is a utility used to enforce supply chain p…8.8
• CVE-2022-35931Nextcloud Password Policy is an app that enables a Nextcloud…2.7
• CVE-2022-35932Nextcloud Talk is a video and audio conferencing app for Nex…5.3
• CVE-2022-35933This package is a PrestaShop module that allows users to pos…6.1