CVE-2022-1507

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafa

5.5 MediumFix available

CVE-2022-1507 is a medium vulnerability (CVSS 5.5) in Chafa Project Chafa, published April 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in chafa 1.10.2-1.

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.89%Unchanged since Apr 28, 2022

What each source reports

CVE List Score used 5.5

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafa

Record: CVE-2022-1507
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2022-24807 5.5

Record: EUVD-2022-24807
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p7m9-59wp-jx9r 5.5

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows...

Record: GHSA-p7m9-59wp-jx9r
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

NVD 5.5

Record: CVE-2022-1507
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

OSV 5.5

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in hpjansson/chafa

Record: CVE-2022-1507
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-1507 5.5

Record: DEBIAN-CVE-2022-1507
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVJLSEC-2026-1089 5.5

Record: JLSEC-2026-1089
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-1507 5.5

Record: UBUNTU-CVE-2022-1507
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2022:10025-1 No score

Security update for chafa

This update for chafa fixes the following issues:

CVE-2022-1507: Fix NULL pointer deref in gif_internal_decode_frame (boo#1198965)

Record: openSUSE-SU-2022:10025-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`chafa` Debian:12	before 1.10.2-1	1.10.2-1
`chafa` Debian:13	before 1.10.2-1	1.10.2-1
`chafa` Debian:14	before 1.10.2-1	1.10.2-1
`Chafa_jll` Julia	All versions	None known
`chafa` Ubuntu:20.04:LTS	All versions, plus listed versions 1.2.1-1	None known
`chafa` Ubuntu:22.04:LTS	All versions, plus listed versions 1.6.0-11.8.0-1	None known
`chafa` SUSE:Package Hub 15 SP3	before 1.4.1-bp153.2.3.1	1.4.1-bp153.2.3.1
`chafa` openSUSE:Leap 15.3	before 1.4.1-bp153.2.3.1	1.4.1-bp153.2.3.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less