CVE-2022-48468

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

5.5 MediumFix available

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.37%Up 0.3 points since Apr 15, 2023

What each source reports

NVD Score used 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE List 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2022-51164 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: EUVD-2022-51164
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g29w-rp5q-p5vq 9.8

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: GHSA-g29w-rp5q-p5vq
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVAZL-26159 5.5

CVE-2022-48468 affecting package protobuf-c for versions less than 1.4.1-1

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: AZL-26159
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2022-48468 5.5

CVE-2022-48468 does not affect BellSoft software

Record: BELL-CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 17 moreShow less

OSV 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-48468 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: DEBIAN-CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVOESA-2023-1255 4.6

protobuf-c security update

This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format.

Security Fix(es):

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.(CVE-2022-48468)

Record: OESA-2023-1255
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Updated: 2026-11-02

OSVOESA-2023-1256 4.6

protobuf-c security update

This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format.

Security Fix(es):

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.(CVE-2022-48468)

Record: OESA-2023-1256
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Updated: 2026-11-02

OSVRHSA-2023:6621 6.2

Red Hat Security Advisory: protobuf-c security update

Record: RHSA-2023:6621
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:6944 6.2

Red Hat Security Advisory: protobuf-c security update

Record: RHSA-2023:6944
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:0406 6.2

Red Hat Security Advisory: protobuf-c security update

Record: RHSA-2024:0406
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:3812 6.2

Red Hat Security Advisory: protobuf-c security update

Record: RHSA-2024:3812
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2023:6621 6.2

Moderate: protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers.

Security Fix(es):

protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section.

Record: RLSA-2023:6621
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-48468 5.5

protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

Record: UBUNTU-CVE-2022-48468
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2023:6621 No score

Moderate: protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers.

Security Fix(es):

protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2023:6621
Updated: 2026-11-02

OSVALSA-2023:6944 No score

Moderate: protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers.

Security Fix(es):

protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2023:6944
Updated: 2026-11-02

OSVCLSA-2025-1760548275 No score

protobuf-c: Fix of CVE-2022-48468

CVE-2022-48468: fix unsigned integer overflow in parse_required_member

Record: CLSA-2025-1760548275
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12885-1 No score

libprotobuf-c-devel-1.4.1-4.1 on GA media

These are all security issues fixed in the libprotobuf-c-devel-1.4.1-4.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12885-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10244-1 No score

libsignal-protocol-c-devel-2.3.3-2.1 on GA media

These are all security issues fixed in the libsignal-protocol-c-devel-2.3.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10244-1
Updated: 2026-11-02

OSVSUSE-SU-2023:1979-1 No score

Security update for protobuf-c

This update for protobuf-c fixes the following issues:

CVE-2022-48468: Fixed an unsigned integer overflow. (bsc#1210323)

Record: SUSE-SU-2023:1979-1
Updated: 2026-11-02

OSVSUSE-SU-2023:2143-1 No score

Security update for protobuf-c

This update for protobuf-c fixes the following issues:

CVE-2022-48468: Fixed an unsigned integer overflow. (bsc#1210323)

Record: SUSE-SU-2023:2143-1
Updated: 2026-11-02

Affected products

protobuf-c project protobuf-c

Affected packages

Affected packages
Package	Affected	Fixed
`protobuf-c` AlmaLinux:9	before 1.3.3-13.el9	1.3.3-13.el9
`protobuf-c-compiler` AlmaLinux:9	before 1.3.3-13.el9	1.3.3-13.el9
`protobuf-c-devel` AlmaLinux:9	before 1.3.3-13.el9	1.3.3-13.el9
`protobuf-c` AlmaLinux:8	before 1.3.0-8.el8	1.3.0-8.el8
`protobuf-c-compiler` AlmaLinux:8	before 1.3.0-8.el8	1.3.0-8.el8
`protobuf-c-devel` AlmaLinux:8	before 1.3.0-8.el8	1.3.0-8.el8
`protobuf-c` Azure Linux:2	before 1.4.1-1	1.4.1-1
`protobuf-c` TuxCare:AlmaLinux:9.2	before 1.3.3-12.el9.tuxcare.els1	1.3.3-12.el9.tuxcare.els1
`protobuf-c-compiler` TuxCare:AlmaLinux:9.2	before 1.3.3-12.el9.tuxcare.els1	1.3.3-12.el9.tuxcare.els1
`protobuf-c-devel` TuxCare:AlmaLinux:9.2	before 1.3.3-12.el9.tuxcare.els1	1.3.3-12.el9.tuxcare.els1

Show 59 moreShow less

Affected packages
Package	Affected	Fixed
`libsignal-protocol-c` Debian:12	before 2.3.3-3	2.3.3-3
`libsignal-protocol-c` Debian:13	before 2.3.3-3	2.3.3-3
`libsignal-protocol-c` Debian:14	before 2.3.3-3	2.3.3-3
`protobuf-c` Debian:12	before 1.4.1-1	1.4.1-1
`protobuf-c` Debian:13	before 1.4.1-1	1.4.1-1
`protobuf-c` Debian:14	before 1.4.1-1	1.4.1-1
`protobuf-c` openEuler:20.03-LTS-SP1	before 1.3.2-5.oe1	1.3.2-5.oe1
`protobuf-c` openEuler:20.03-LTS-SP3	before 1.3.2-5.oe1	1.3.2-5.oe1
`protobuf-c` Red Hat:enterprise_linux:9::baseos	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-compiler-debuginfo` Red Hat:enterprise_linux:9::baseos	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-debuginfo` Red Hat:enterprise_linux:9::baseos	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-debugsource` Red Hat:enterprise_linux:9::baseos	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-compiler` Red Hat:enterprise_linux:9::crb	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-compiler-debuginfo` Red Hat:enterprise_linux:9::crb	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-debuginfo` Red Hat:enterprise_linux:9::crb	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-debugsource` Red Hat:enterprise_linux:9::crb	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c-devel` Red Hat:enterprise_linux:9::crb	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c-compiler` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c-compiler-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c-devel` Red Hat:enterprise_linux:8::appstream	before 0:1.3.0-8.el8	0:1.3.0-8.el8
`protobuf-c` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c-compiler` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c-compiler-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c-debugsource` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c-devel` Red Hat:rhel_eus:8.6::appstream	before 0:1.3.0-8.el8_6	0:1.3.0-8.el8_6
`protobuf-c` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c-compiler` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c-compiler-debuginfo` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c-debuginfo` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c-debugsource` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c-devel` Red Hat:rhel_eus:8.8::appstream	before 0:1.3.0-8.el8_8	0:1.3.0-8.el8_8
`protobuf-c` Rocky Linux:9	before 0:1.3.3-13.el9	0:1.3.3-13.el9
`protobuf-c` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	before 1.3.0-150000.3.3.1	1.3.0-150000.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server 15 SP1-LTSS	before 1.3.0-150000.3.3.1	1.3.0-150000.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	before 1.3.0-150000.3.3.1	1.3.0-150000.3.3.1
`protobuf-c` SUSE:Linux Enterprise Module for Basesystem 15 SP4	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise Real Time 15 SP3	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server 15 SP2-LTSS	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server 15 SP3-LTSS	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Manager Proxy 4.2	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Manager Server 4.2	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Enterprise Storage 7	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` SUSE:Enterprise Storage 7.1	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` openSUSE:Leap 15.4	before 1.3.2-150200.3.3.1	1.3.2-150200.3.3.1
`protobuf-c` Ubuntu:14.04:LTS	All versions, plus listed versions 0.14-1ubuntu10.15-10.15-1build1	None known
`protobuf-c` Ubuntu:16.04:LTS	All versions, plus listed versions 1.0.2-1build21.1.1-11.2.1-1	None known
`protobuf-c` Ubuntu:18.04:LTS	All versions, plus listed versions 1.2.1-2	None known
`protobuf-c` Ubuntu:20.04:LTS	All versions, plus listed versions 1.3.1-1build11.3.2-11.3.3-11.3.3-1ubuntu0.11.3.3-1ubuntu0.3	None known
`protobuf-c` Ubuntu:22.04:LTS	All versions, plus listed versions 1.3.3-1build21.3.3-1ubuntu11.3.3-1ubuntu21.3.3-1ubuntu2.1	None known
`libsignal-protocol-c` openSUSE:Tumbleweed	before 2.3.3-2.1	2.3.3-2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-48468 is a medium vulnerability (CVSS 5.5) in Protobuf-c Project Protobuf-c, published April 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in protobuf-c 1.3.3-13.el9.

References

Show 35 moreShow less