CVE-2022-4743 - Vulnerability Details - OpenCVE

A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Libsdl	Simple Directmedia Layer
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:libsdl:simple_directmedia_layer:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2022-4743
https://bugzilla.redhat.com/show_bug.cgi?id=2156290
https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b
https://github.com/libsdl-org/SDL/pull/6269
https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html
https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html
https://nvd.nist.gov/vuln/detail/CVE-2022-4743
https://security.gentoo.org/glsa/202305-18
https://www.cve.org/CVERecord?id=CVE-2022-4743

History

Tue, 25 Nov 2025 21:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00054}`	epss `{'score': 0.00055}`

Tue, 08 Apr 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-01-12T00:00:00.000Z

Updated: 2025-11-25T21:04:08.359Z

Reserved: 2022-12-26T00:00:00.000Z

Link: CVE-2022-4743

Vulnrichment

Updated: 2025-11-25T21:04:08.359Z

NVD

Status : Modified

Published: 2023-01-12T19:15:24.457

Modified: 2025-11-25T21:15:53.873

Link: CVE-2022-4743

Redhat

Severity : Moderate

Publid Date: 2022-09-21T00:00:00Z

Links: CVE-2022-4743 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-4743", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2025-11-25T21:04:08.359Z", "dateReserved": "2022-12-26T00:00:00.000Z", "datePublished": "2023-01-12T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-05-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected."}], "affected": [{"vendor": "n/a", "product": "SDL2", "versions": [{"version": "Affects SDL2 v2.0.4 and above, Fixed-in sdl-2.26.0, sdl-prerelease-2.25.1", "status": "affected"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290"}, {"url": "https://access.redhat.com/security/cve/CVE-2022-4743"}, {"url": "https://github.com/libsdl-org/SDL/pull/6269"}, {"url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b"}, {"name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3314-1] libsdl2 security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html"}, {"name": "GLSA-202305-18", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202305-18"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "NA"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290", "tags": ["x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2022-4743", "tags": ["x_transferred"]}, {"url": "https://github.com/libsdl-org/SDL/pull/6269", "tags": ["x_transferred"]}, {"url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3314-1] libsdl2 security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html"}, {"name": "GLSA-202305-18", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202305-18"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-25T21:04:08.359Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-401", "lang": "en", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-08T13:46:37.199918Z", "id": "CVE-2022-4743", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T13:47:14.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290", "tags": ["x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2022-4743", "tags": ["x_transferred"]}, {"url": "https://github.com/libsdl-org/SDL/pull/6269", "tags": ["x_transferred"]}, {"url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html", "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3314-1] libsdl2 security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202305-18", "name": "GLSA-202305-18", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-25T21:04:08.359Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-4743", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-08T13:46:37.199918Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T13:47:09.500Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "SDL2", "versions": [{"status": "affected", "version": "Affects SDL2 v2.0.4 and above, Fixed-in sdl-2.26.0, sdl-prerelease-2.25.1"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290"}, {"url": "https://access.redhat.com/security/cve/CVE-2022-4743"}, {"url": "https://github.com/libsdl-org/SDL/pull/6269"}, {"url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b"}, {"url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html", "name": "[debian-lts-announce] 20230208 [SECURITY] [DLA 3314-1] libsdl2 security update", "tags": ["mailing-list"]}, {"url": "https://security.gentoo.org/glsa/202305-18", "name": "GLSA-202305-18", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "NA"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-05-03T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-4743", "state": "PUBLISHED", "dateUpdated": "2025-11-25T21:04:08.359Z", "dateReserved": "2022-12-26T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-01-12T00:00:00.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libsdl:simple_directmedia_layer:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC731AEE-6D02-42D4-9F58-468E2749FDE7", "versionEndExcluding": "2.26.0", "versionStartIncluding": "2.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected."}, {"lang": "es", "value": "Se descubri\u00f3 un posible problema de p\u00e9rdida de memoria en SDL2 en la funci\u00f3n GLES_CreateTexture() en SDL_render_gles.c. La vulnerabilidad permite a un atacante provocar un ataque de denegaci\u00f3n de servicio. La vulnerabilidad afecta a SDL2 v2.0.4 y superiores. SDL-1.x no se ve afectado."}], "id": "CVE-2022-4743", "lastModified": "2025-11-25T21:15:53.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-12T19:15:24.457", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-4743"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libsdl-org/SDL/pull/6269"}, {"source": "secalert@redhat.com", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/202305-18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-4743"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156290"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libsdl-org/SDL/commit/00b67f55727bc0944c3266e2b875440da132ce4b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libsdl-org/SDL/pull/6269"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00024.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202305-18"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}