CVE-2022-46149 [Medium] | Out-of-bounds Read in Capnproto

Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. The `capnp` Rust crate has fixes available in versions 0.13.7, 0.14.11, and 0.15.2.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-30	0.10%	0.15%	+0.06%
2	2025-11-21	0.54%	0.10%	-0.44%
3	2025-11-18	—	0.54%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-30

0.10%

0.15%

+0.06%

2025-11-21

0.54%

0.10%

-0.44%

2025-11-18

—

0.54%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.2	2.7	[email protected]
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.8	2.5	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.4

3.1

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.2

2.7

[email protected]

5.4

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.8

2.5

[email protected]

OS Trackers for CVE-2022-46149

vendor	priority	summary	link
`alpine`	medium	CVE-2022-46149: 1 source package rows (capnproto); 1 state rows across 1 repos (3.17-community); fixed 0, open 1.	https://security.alpinelinux.org/vuln/CVE-2022-46149
`debian`	not yet assigned	CVE-2022-46149 not yet assigned priority: Debian including 2 source packages (capnproto, rust-capnp), 9 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 8, open 1.	https://security-tracker.debian.org/tracker/CVE-2022-46149
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2022-46149
`suse`	medium	CVE-2022-46149 severity moderate: SUSE including 12 source package names (capnproto-0.10.3-1.1, capnproto-0.9.1-150400.3.4.1, …), 29 product×package rows across 13 product lines (SUSE Linux Enterprise Module for Desktop Applications 15 SP4, SUSE Linux Enterprise Module for Desktop Applications 15 SP5, … (13 product lines)): Fixed 29.	https://www.suse.com/security/cve/CVE-2022-46149/
`ubuntu`	low	CVE-2022-46149 low priority: Ubuntu including 2 source packages (capnproto, interchange), 20 status rows across 13 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): ignored 7, not-affected 6, DNE 4, needed 1, needs-triage 1, released 1.	https://ubuntu.com/security/CVE-2022-46149

Affected software / configurations for CVE-2022-46149

Vendor	Product	Version	Raw CPE
capnproto	capnproto	< 0.7.1	cpe:2.3:a:capnproto:capnproto::::::::
capnproto	capnproto	>= 0.9.0, < 0.9.2	cpe:2.3:a:capnproto:capnproto::::::::
capnproto	capnproto	>= 0.10.0, < 0.10.3	cpe:2.3:a:capnproto:capnproto::::::::
capnproto	capnproto	0.8.0	cpe:2.3:a:capnproto:capnproto:0.8.0:::::::*
capnproto	capnp	< 0.13.7	cpe:2.3:a:capnproto:capnp::::::rust::*
capnproto	capnp	>= 0.14.0, < 0.14.11	cpe:2.3:a:capnproto:capnp::::::rust::*
capnproto	capnp	>= 0.15.0, < 0.15.2	cpe:2.3:a:capnproto:capnp::::::rust::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*

References for CVE-2022-46149

URL	Tags
https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9	Patch Third Party Advisory
https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx	Patch Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAHKLUMJAXJEV5BPBS5XXWBQ3ZTHGOLY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTS6TWD6K2NKXLEEFBPROQXMOFUTEYWY/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WKXM4JAFXLTXU5IQB3OUBQVCIICZWGYX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZOCQQOPMVQOFUWBWAGVGN76OYAV3WXY4/

URL

CVE-2022-46149 | Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list.

Exploit prediction scoring system (EPSS) score for CVE-2022-46149

Common vulnerability scoring system (CVSS) metrics for CVE-2022-46149

Weakness enumeration for CVE-2022-46149

GitHub Security Advisory for CVE-2022-46149

OS Trackers for CVE-2022-46149

Affected software / configurations for CVE-2022-46149

References for CVE-2022-46149