CVE-2022-31783

What it actually does

Out-of-bounds write during rule compilation in compileTranslationTable.c triggered by malformed translation table input, resulting in memory corruption.

Why it matters to the business

Applications relying on Liblouis for Braille or accessibility translation may crash or become unstable when processing untrusted tables, disrupting accessibility workflows and requiring restarts or manual intervention.

How an attack unfolds

An attacker crafts a malicious translation table containing specially formed rules and supplies it to a Liblouis client such as lou_trace; the library parses the table, the faulty compileRule function writes beyond allocated bounds, and memory corruption occurs.

How to fix it

Upgrade liblouis to the commit ff747ec5e1ac54d54194846f6fe5bfc689192a85 or later release containing the fix.

How to confirm the fix worked

Confirm the installed version is newer than the vulnerable release, then attempt to process the original demonstration table with lou_trace and verify the process no longer crashes or writes out of bounds.

Typical attack path

1. Obtain or generate a crafted translation table file
2. Invoke a Liblouis utility or application with the malicious table as input
3. Trigger rule compilation path that reaches the vulnerable compileRule function
4. Observe resulting memory corruption and application instability

How to detect it

Review process crash logs and core dumps for Liblouis utilities; monitor for repeated invocations of lou_trace or similar tools with unexpected table files.

What your security team should do

• Prioritize upgrade of all Liblouis installations to the fixed commit within standard change windows
• Inventory downstream packages and applications that embed Liblouis and schedule coordinated updates
• Add Liblouis version checks to software composition analysis pipelines