CVE-2022-44797

CRITICAL

Published Nov 7, 20223y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Nov 7, 2022 3y ago

Last Modified Jun 17, 2026 2w ago

Description

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

Patch Available

Vendor	Product	Version	Range
btcd_project	btcd	*	<0.23.2
lightning_network_daemon_project	lightning_network_daemon	*	<0.15.2

github.com https://github.com/btcsuite/btcd/pull/1896

PatchThird Party Advisory
github.com https://github.com/btcsuite/btcd/releases/tag/v0.23.2

Release NotesThird Party Advisory
github.com https://github.com/lightningnetwork/lnd/issues/7002

ExploitIssue TrackingThird Party Advisory
github.com https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta

Release NotesThird Party Advisory

github.com https://github.com/btcsuite/btcd/pull/1896

PatchThird Party Advisory