Security readout for executives and security teams
Plain-English summary
This CVE describes a heap buffer overflow in OTFCC's otfccdump build at commit 617837b. The documented impact is denial of service: a crash or availability loss, not data theft or privilege escalation. User interaction is required, so urgency depends on whether untrusted inputs reach this tool.
Executive priority
Treat this as a moderate availability risk. Prioritize teams that process external files or run OTFCC in automated services. It is less urgent than remote code execution or data exposure, but exposed processing pipelines should be reviewed promptly.
Technical view
CVE-2022-35063 is CWE-787 out-of-bounds write in /release-x64/otfccdump+0x6e41a8. CVSS 3.1 is 6.5: network attack vector, low complexity, no privileges, user interaction required, unchanged scope, high availability impact, no confidentiality or integrity impact.
Likely exposure
Exposure is most likely where OTFCC or otfccdump built from commit 617837b, or derived binaries, process untrusted files in user, CI, conversion, or content-processing workflows. The source bundle lists no CPE, vendor, product, or version range beyond the commit reference.
Exploitation context
The CVE is not in CISA KEV, and the source bundle does not show confirmed active exploitation. A GitHub PoC reference is listed, so public technical material may exist, but the provided evidence supports availability-focused risk only.
Researcher notes
The source data is sparse: affected vendor and product are listed as n/a, and no fixed version is named. Analysis should avoid broad product claims. The CVSS vector indicates interaction is required and availability is the only scored security impact.
Mitigation direction
- Inventory OTFCC and otfccdump usage, especially builds from commit 617837b.
- Check upstream or vendor guidance for fixed builds or recommended workarounds.
- Avoid processing untrusted inputs with affected binaries until guidance is confirmed.
- Run affected tooling with least privilege and resource isolation.
- Restrict automated pipelines that feed external files into otfccdump.
Validation and detection
- Confirm whether OTFCC or otfccdump exists in endpoints, build images, or CI runners.
- Map binary provenance to commit 617837b or any downstream packaged build.
- Review workflows for untrusted input reaching otfccdump.
- Check monitoring for crashes or repeated failures in OTFCC processing jobs.
- Track the CVE record and referenced project material for fix clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35063 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://drive.google.com/file/d/1VW_6SXTGWABHMqW6m-hpfpbedaJFFG5b/view?usp=sharingCVE reference · x_refsource_MISC
- https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35063.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.