---
id: CVE-2022-44940
aliases:
  - GHSA-5pcj-3m26-w633
  - PYSEC-2022-43144
  - PYSEC-2022-43151
title: Patchelf out-of-bounds read
summary: Patchelf out-of-bounds read
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: patchelf
product: patchelf
ecosystem: pip
affected:
  - patchelf < 0.16.1.0
patched:
  - patchelf 0.16.1.0
published: '2022-12-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:56.232343700Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5pcj-3m26-w633'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-44940'
  - url: 'https://github.com/NixOS/patchelf/pull/419'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/patchelf/PYSEC-2022-43144.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/pypatchelf/PYSEC-2022-43151.yaml
tags:
  - osv
  - pip
epss: 0.01042
epssPercentile: 0.62583
ingestedAt: '2026-09-12T03:13:01.661Z'
---

## Overview

Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc.

## Affected packages

- `patchelf < 0.16.1.0`

## Remediation

Upgrade to a patched release:

- `patchelf 0.16.1.0`