How severe is CVE-2022-4996?

CVE-2022-4996 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2022-4996 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2022-4996?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-4996 published?

CVE-2022-4996 was published on 2026-08-20 and last updated on 2026-08-21.

CVE-2022-4996

CVE-2022-4996 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1077.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
CVSS v4: 5.5
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-1077
Published: 2026-08-20
Last modified: 2026-08-21

Description

A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to apply a patch to resolve this issue.

Frequently asked questions

What is CVE-2022-4996?: A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to apply a patch to resolve this issue.
How severe is CVE-2022-4996?: CVE-2022-4996 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2022-4996 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2022-4996?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-4996 published?: CVE-2022-4996 was published on 2026-08-20 and last updated on 2026-08-21.

References

Other CWE-1077 vulnerabilities

CVE-2025-55658 — Medium (CVSS 6.5): GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function…
CVE-2023-4720 — Medium (CVSS 5.5): Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV.
CVE-2022-4293 — Medium (CVSS 5.5): Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

Browse all CWE-1077 vulnerabilities →