High
nanopb — security advisory
In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation.
- Products
- nanopb
- Affected versions
- 0.4.1-1, 0.4.1-1ubuntu0.1~esm1, 0.4.4-2, 0.4.5-1, 0.4.5-2, 0.4.7-2, 0.4.7-3, 0.4.8-1, 0.4.9.1-1, 0.4.9.1-1build1, 0.4.9.1-2
- Fixed versions
- Not specified
- CVEs
- CVE-2022-20203
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:44 UTC · Revision 1
Source evidence
In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation.
osv:UBUNTU-CVE-2022-20203
nanopb
Fixed versions: Not specified
nanopb
Fixed versions: Not specified
nanopb
Fixed versions: Not specified
nanopb
Fixed versions: Not specified
nanopb
Fixed versions: Not specified
nanopb
Fixed versions: Not specified
Complete source record
{
"id": "7b73e7f9e810419760de4a6e9b177a58d59298cd89da01611159be17dbf45424",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-20203",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-20203",
"summary": "In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation.",
"evidence": "osv:UBUNTU-CVE-2022-20203",
"products": [
{
"name": {
"value": "nanopb",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.4.1-1ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "nanopb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "0.4.5-1",
"evidence": "/affected/1/versions"
},
{
"value": "0.4.5-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "nanopb",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.7-2",
"evidence": "/affected/2/versions"
},
{
"value": "0.4.7-3",
"evidence": "/affected/2/versions"
},
{
"value": "0.4.8-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "nanopb",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.9.1-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "nanopb",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.9.1-1build1",
"evidence": "/affected/4/versions"
},
{
"value": "0.4.9.1-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "nanopb",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4.9.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "0.4.9.1-1build1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2022-20203",
"aliases": [
"UBUNTU-CVE-2022-20203"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"0.4.1-1",
"0.4.1-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.1-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"0.4.4-2",
"0.4.5-1",
"0.4.5-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.5-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"0.4.7-2",
"0.4.7-3",
"0.4.8-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.8-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"0.4.9.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.9.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"0.4.9.1-1build1",
"0.4.9.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.9.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nanopb",
"purl": "pkg:deb/ubuntu/nanopb?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"0.4.9.1-1",
"0.4.9.1-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-20203.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "nanopb",
"binary_version": "0.4.9.1-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:56:01.756934982Z",
"provider": "osv",
"upstream": [
"CVE-2022-20203"
],
"references": [
"https://ubuntu.com/security/CVE-2022-20203",
"https://source.android.com/security/bulletin/android-12l",
"https://www.cve.org/CVERecord?id=CVE-2022-20203"
]
},
"related_cves": [
{
"value": "CVE-2022-20203",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354615,
"published_at": "2022-06-15T22:15:00+00:00"
}