Log in Start free

Vulnerability · Published May 4, 2022 · Assigned by mitre

CVE-2022-27470

High 7.8

In plain English

A high-severity security flaw in the sdl2_ttf package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20sdl2_ttf2.20.0-r0ALPINE-CVE-2022-27470
Alpine:v3.21sdl2_ttf2.20.0-r0ALPINE-CVE-2022-27470
Alpine:v3.22sdl2_ttf2.20.0-r0ALPINE-CVE-2022-27470
Alpine:v3.23sdl2_ttf2.20.0-r0ALPINE-CVE-2022-27470
Alpine:v3.24sdl2_ttf2.20.0-r0ALPINE-CVE-2022-27470
Debian:12libsdl2-ttf2.0.18+dfsg-3DEBIAN-CVE-2022-27470
Debian:13libsdl2-ttf2.0.18+dfsg-3DEBIAN-CVE-2022-27470
Debian:14libsdl2-ttf2.0.18+dfsg-3DEBIAN-CVE-2022-27470
Ubuntu:22.04:LTSlibsdl2-ttfno fix listedUBUNTU-CVE-2022-27470
Ubuntu:24.04:LTSlibsdl2-ttfno fix listedUBUNTU-CVE-2022-27470
Ubuntu:25.10libsdl2-ttfno fix listedUBUNTU-CVE-2022-27470
Ubuntu:26.04:LTSlibsdl2-ttfno fix listedUBUNTU-CVE-2022-27470
Ubuntu:26.10libsdl2-ttfno fix listedUBUNTU-CVE-2022-27470

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References