Every CVE Search/ Get API key

CVE-2022-48554

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is...

5.5 MediumFix available

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.68%Up 0.6 points since Aug 23, 2023
90%50%10%1%

What each source reports

NVD Score used 5.5

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
CVE-2022-48554
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
CVE-2022-48554
Updated
2026-11-02
EUVDEUVD-2022-51250 No score

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
EUVD-2022-51250
Updated
2026-11-03
GitHub AdvisoriesGHSA-wpfg-7xq2-mv49 5.5

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is...

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
GHSA-wpfg-7xq2-mv49
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVAZL-28055 5.5

CVE-2022-48554 affecting package file for versions less than 5.40-3

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
AZL-28055
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1574 5.5

file security update

The program checks to see if the file is empty,or if its some sort of special file.

Security Fix(es):

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.(CVE-2022-48554)

Record
OESA-2023-1574
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2024:2512 5.5

Red Hat Security Advisory: file security update

Record
RHSA-2024:2512
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2024:2512 5.5

Low: file security update

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Security Fix(es):

  • file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

Record
RLSA-2024:2512
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-48554 5.5

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
UBUNTU-CVE-2022-48554
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2024:2512 No score

Low: file security update

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Security Fix(es):

  • file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2024:2512
Updated
2026-11-02
OSVCLSA-2024-1717691179 No score

file: Fix of CVE-2022-48554

  • CVE-2022-48554: fix stack-based buffer over-read in file_copystr in funcs.c
Record
CLSA-2024-1717691179
Updated
2026-11-02
OSV No score

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
CVE-2022-48554
Updated
2026-11-02
OSVDEBIAN-CVE-2022-48554 No score

File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

Record
DEBIAN-CVE-2022-48554
Updated
2026-11-03
OSVMGASA-2023-0268 No score

Updated file packages fix security vulnerability

File before 5.43 has a stack-based buffer over-read in file_copystr in funcs.c. (CVE-2022-48554)

Record
MGASA-2023-0268
Updated
2026-11-02
OSVUSN-6359-1 No score

file vulnerability

It was discovered that file incorrectly handled certain malformed files. An attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.

Record
USN-6359-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
file
AlmaLinux:9
 before 5.39-16.el9
5.39-16.el9
file-devel
AlmaLinux:9
 before 5.39-16.el9
5.39-16.el9
file-libs
AlmaLinux:9
 before 5.39-16.el9
5.39-16.el9
python3-file-magic
AlmaLinux:9
 before 5.39-16.el9
5.39-16.el9
file
Azure Linux:2
 before 5.40-3
5.40-3
file
TuxCare:AlmaLinux:9.2
 before 5.39-12.1.el9_2.tuxcare.els1
5.39-12.1.el9_2.tuxcare.els1
file-devel
TuxCare:AlmaLinux:9.2
 before 5.39-12.1.el9_2.tuxcare.els1
5.39-12.1.el9_2.tuxcare.els1
file-libs
TuxCare:AlmaLinux:9.2
 before 5.39-12.1.el9_2.tuxcare.els1
5.39-12.1.el9_2.tuxcare.els1
file-static
TuxCare:AlmaLinux:9.2
 before 5.39-12.1.el9_2.tuxcare.els1
5.39-12.1.el9_2.tuxcare.els1
python3-file-magic
TuxCare:AlmaLinux:9.2
 before 5.39-12.1.el9_2.tuxcare.els1
5.39-12.1.el9_2.tuxcare.els1
Show 22 moreShow less
Affected packages
PackageAffectedFixed
file
Debian:12
 before 1:5.44-1
1:5.44-1
file
Debian:13
 before 1:5.44-1
1:5.44-1
file
Debian:14
 before 1:5.44-1
1:5.44-1
file
Debian:11
 before 1:5.39-3+deb11u1, plus listed versions
1:5.39-3
1:5.39-3+deb11u1
file
Mageia:8
 before 5.39-4.1.mga8
5.39-4.1.mga8
file
openEuler:20.03-LTS-SP1
 before 5.39-7.oe1
5.39-7.oe1
file
openEuler:20.03-LTS-SP3
 before 5.39-7.oe1
5.39-7.oe1
file
openEuler:22.03-LTS
 before 5.41-3.oe2203sp2
5.41-3.oe2203sp2
file
openEuler:22.03-LTS-SP1
 before 5.41-3.oe2203sp1
5.41-3.oe2203sp1
file
openEuler:22.03-LTS-SP2
 before 5.41-3.oe2203sp2
5.41-3.oe2203sp2
python3-file-magic
Red Hat:enterprise_linux:9::appstream
 before 0:5.39-16.el9
0:5.39-16.el9
file
Red Hat:enterprise_linux:9::baseos
 before 0:5.39-16.el9
0:5.39-16.el9
file-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:5.39-16.el9
0:5.39-16.el9
file-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:5.39-16.el9
0:5.39-16.el9
file-libs
Red Hat:enterprise_linux:9::baseos
 before 0:5.39-16.el9
0:5.39-16.el9
file-libs-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:5.39-16.el9
0:5.39-16.el9
file-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:5.39-16.el9
0:5.39-16.el9
file-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:5.39-16.el9
0:5.39-16.el9
file-devel
Red Hat:enterprise_linux:9::crb
 before 0:5.39-16.el9
0:5.39-16.el9
file-libs-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:5.39-16.el9
0:5.39-16.el9
file
Rocky Linux:9
 before 0:5.39-16.el9
0:5.39-16.el9
file
Ubuntu:22.04:LTS
 before 1:5.41-3ubuntu0.1, plus listed versions
1:5.39-31:5.39-3build11:5.41-21:5.41-3
1:5.41-3ubuntu0.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-48554 is a medium vulnerability (CVSS 5.5) in File Project File, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in file 5.39-16.el9.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open