Cloudanix VulnDB

CVE-2022-44081

Medium · 5.5

CVSS

5.5

EPSS

0.3%

Published

Oct 31, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the code that reads certain image files can make the network analysis tool crash when someone opens a specially made picture.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
No Fix Yet
Effort
Other
Patch risk
Other

What it actually does

The vulnerability triggers a segmentation fault (crash) inside the pngdetail function of the embedded lodepng library when a specially crafted PNG file is parsed, resulting in denial of service.

Why it matters to the business

Users or automated processes that open untrusted PNG files with affected Wireshark installations may experience an immediate application crash, interrupting network analysis workflows until the process is restarted.

How an attack unfolds

An attacker crafts a malicious PNG file that reaches the pngdetail routine; when the file is opened locally in Wireshark, the fault occurs and the application terminates. Public exploit code already exists, although the attack requires local access and user interaction.

How to fix it

Upgrade Wireshark to the fixed Debian packages: 3.4.10-0+deb11u1 on Debian 11, or 3.6.0-1 on Debian 12 and 13. Rebuild or reinstall any custom packages that statically link the vulnerable lodepng version.

How to confirm the fix worked

Confirm the installed Wireshark version matches or exceeds the fixed package listed for the respective Debian release; test by attempting to open a known-triggering PNG sample in a controlled environment and verifying the application no longer crashes.

Typical attack path

  1. Attacker prepares a malformed PNG file designed to trigger the pngdetail fault
  2. Victim opens the file with an affected Wireshark binary on Debian
  3. pngdetail processes the file and dereferences invalid memory
  4. Process crashes, producing a segmentation fault and terminating the application

How to detect it

Review system and application logs for segmentation fault entries mentioning Wireshark or pngdetail around the time of PNG file access; correlate with file-access audit logs showing recently opened PNGs from untrusted sources.

What your security team should do

  • Apply the listed Debian package updates immediately on all affected systems
  • Block or sandbox untrusted PNG files from being opened with Wireshark until patches are deployed
  • Monitor upstream Wireshark and Debian advisories for any additional backported fixes

The record

Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:24.04:LTS lodepng 0 No fix
Ubuntu:24.10 lodepng 0 No fix
Ubuntu:25.04 lodepng 0 No fix
Ubuntu:25.10 lodepng 0 No fix

Related vulnerabilities