Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function

CVE-2022-28331

What is CVE-2022-28331?

The Apache Portable Runtime on Windows versions 1.7.0 and earlier contains a vulnerability where an integer overflow may result in writing beyond the end of a stack-based buffer during socket operations in the apr_socket_sendv() function. This flaw can potentially lead to uncontrolled memory corruption, making systems vulnerable to various forms of attacks that exploit this overflow.

References