CVE-2022-46742 | Code injection in paddle.audio.functional.get_window in Padd… | CVSS 10.0 CRITICAL

Description

Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

CVE ID: CVE-2022-46742
State: PUBLISHED
Assigner: Baidu
Reserved: 2022-12-07 05:44 UTC
Published: 2022-12-07 08:16 UTC
Last updated: 2025-04-22 21:00 UTC
Primary CWE: CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product: PaddlePaddle / PaddlePaddle
Sources: cve.org · NVD

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

SSVC — CISA Coordinator

Affected products (1)

Vendor	Product	Platform	Versions
PaddlePaddle	PaddlePaddle	—	2.4.0-rc0

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

References (1)