CVE-2022-43974: Matrixssl

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer overflow and achieve remote code execution. This is fixed in 4.6.0.

Affected products

• Matrixssl Matrixssl: from 4.0.0, before 4.6.0 (fixed in 4.6.0)

Published 2023-01-09. Last modified 2026-06-17.