CVE-2022-4291 Aswjsflt.dll in Avast Antivirus windows caused a crash of the Mozilla Firefox browser due to heap corruption
Heap corruption in Avast's aswjsflt.dll allows attackers to crash browsers and potentially bypass application sandboxes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4291?
CVE-2022-4291 is a high-severity memory corruption vulnerability in NortonLifelock Avast Antivirus, published on 7 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component.
Which versions are affected by CVE-2022-4291?
It affects 1 product.
Products include Avast Script Shield.
How do I fix CVE-2022-4291?
No fix has been published for CVE-2022-4291 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-4291 being exploited?
There is no known exploitation of CVE-2022-4291 in the wild and no public exploit code.
Sources
Also known as GHSA-m5gg-2gxj-3qqx.