CVE-2022-36052 Out-of-bounds read when decompressing UDP header

Medium 5.9 Published 1 Sep 2022 Updated 23 Apr 2025

An out-of-bounds read in Contiki-NG's 6LoWPAN UDP header processing allows attackers to cause crashes or leak memory via crafted packets.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-36052?

CVE-2022-36052 is a medium-severity memory corruption vulnerability in contiki-ng, published on 1 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. The 6LoWPAN implementation in Contiki-NG may cast a UDP header structure at a certain offset in a packet buffer. The code does not check whether the packet buffer is large enough to fit a full UDP header structure from the offset where the casting is made. Hence, it is possible to cause an out-of-bounds read beyond the packet buffer. The problem affects anyone running devices with Contiki-NG versions previous to 4.8, and which may receive 6LoWPAN packets from external parties. The problem has been patched in Contiki-NG version 4.8.

Weakness: CWE-125

Which versions are affected by CVE-2022-36052?

It affects 1 product.

Products include Contiki-Ng Contiki-Ng.

How do I fix CVE-2022-36052?

No fix has been published for CVE-2022-36052 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-36052 being exploited?

There is no known exploitation of CVE-2022-36052 in the wild and no public exploit code.

Sources

Also known as GHSA-vwr8-6mqv-x7f5.