CVE-2022-0609 — Use after free in CefSharp.Wpf.HwndHost — CVE Details

HIGH

Actively Exploited

Use after free in Animation

Published February 22, 2022Updated November 8, 2023Source: osv

What Should I Do?

Patch Immediately

This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.

Summary

CVE-2022-0609: Use after free in Animation - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0609 Google is aware of reports that exploits for CVE-2022-0609 exist in the wild. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available. There is currently little other public information on the issue other than it has been flagged as `High` severity.

Advisory Timeline

First published February 22, 2022 (1692 days ago).
Last revised November 8, 2023 — 623 days after initial publication.
Added to CISA's Known Exploited Vulnerabilities catalog 8 days before publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update CefSharp.Wpf.HwndHost to 98.1.210 or later

dotnet add package CefSharp.Wpf.HwndHost --version 98.1.210

NuGet

Update CefSharp.WinForms.NETCore to 98.1.210 or later

dotnet add package CefSharp.WinForms.NETCore --version 98.1.210

NuGet

Update CefSharp.Common to 98.1.210 or later

dotnet add package CefSharp.Common --version 98.1.210

NuGet

Update CefSharp.WinForms to 98.1.210 or later

dotnet add package CefSharp.WinForms --version 98.1.210

NuGet

Update CefSharp.OffScreen.NETCore to 98.1.210 or later

dotnet add package CefSharp.OffScreen.NETCore --version 98.1.210

NuGet

Update CefSharp.Wpf.NETCore to 98.1.210 or later

dotnet add package CefSharp.Wpf.NETCore --version 98.1.210

NuGet

Update CefSharp.Wpf to 98.1.210 or later

dotnet add package CefSharp.Wpf --version 98.1.210

NuGet

Update CefSharp.Common.NETCore to 98.1.210 or later

dotnet add package CefSharp.Common.NETCore --version 98.1.210

NuGet

Update CefSharp.OffScreen to 98.1.210 or later

dotnet add package CefSharp.OffScreen --version 98.1.210

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (9)

Affects 1 ecosystem: nuget (9).

Package	Ecosystem	Affected	Fixed In
CefSharp.Wpf.HwndHost	nuget	83.4.20-pre, 84.4.10, 85.3.121, 85.3.130 (+18 more)	98.1.210
CefSharp.WinForms.NETCore	nuget	87.1.130-pre, 87.1.131-pre, 87.1.132, 88.2.40-pre (+34 more)	98.1.210
CefSharp.Common	nuget	31.0.0-pre1, 33.0.0, 33.0.2, 33.1.0-pre01 (+122 more)	98.1.210
CefSharp.WinForms	nuget	1.25.3, 33.0.0, 33.0.2, 33.1.0-pre01 (+121 more)	98.1.210
CefSharp.OffScreen.NETCore	nuget	87.1.130-pre, 87.1.131-pre, 87.1.132, 88.2.40-pre (+34 more)	98.1.210
CefSharp.Wpf.NETCore	nuget	87.1.130-pre, 87.1.131-pre, 87.1.132, 88.2.40-pre (+34 more)	98.1.210
CefSharp.Wpf	nuget	1.25.2-perlun0, 1.25.3, 1.25.4, 1.25.5 (+129 more)	98.1.210
CefSharp.Common.NETCore	nuget	87.1.130-pre, 87.1.131-pre, 87.1.132, 88.2.40-pre (+34 more)	98.1.210
CefSharp.OffScreen	nuget	37.0.0, 37.0.0-pre01, 37.0.0-pre02, 37.0.1 (+116 more)	98.1.210

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-416
Use After FreeMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-0609?: Use after free in Animation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2022-0609?: CVE-2022-0609 affects CefSharp.Wpf.HwndHost, CefSharp.WinForms.NETCore and CefSharp.Common (and 6 more). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-0609 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.8

High exploitability or significant impact. Prioritize remediation within days.

Known Exploited Vulnerability

This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Added to KEV catalog: February 15, 2022

Remediation deadline: March 1, 2022

Also Known As

GHSA-vv6j-ww6x-54gx

Related CVEs

GHSA-f87w-3j5w-v58p
HIGH
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
CVE-2026-106112
HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
CVE-2026-106115
HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
CVE-2020-16009
HIGH
Inappropriate implementation in V8
CVE-2026-48796
MEDIUM
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies