# CVE-2022-2294: Heap buffer overflow in WebRTC

SDP munging that removes a simulcast rid encoding causes WebRTC to reconcile mismatched encoding vectors, writing out of bounds on the heap in Chrome/Safari.

- Payout: Real-world hack
- Severity: high
- Program: WebRTC (in-the-wild exploitation targeted Chrome)
- Credited: Natalie Silvanovich, Project Zero
- Disclosed: 2022-07-04
- CVE: CVE-2022-2294
- Write-up quality: 7/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-2294.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-2294
- Tags: domain:browser impact:mass-exploit impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:source-review vuln:memory-corruption

**Target:** WebRTC RTCPeerConnection SDP handling (Chrome/Safari)
**Root cause:** LocalConnection keeps a vector of supported encodings; munging the SDP creates a second vector of current encodings. Reconciliation copies properties between vectors of differing length, writing out of bounds when an encoding is removed.
**Steps:**
1. Create RTCPeerConnection with iceServers [] and iceTransportPolicy relay.
2. addTransceiver with a canvas captureStream track and two sendEncodings with unique alphabetic rids (a, b).
3. createOffer, then regex-replace to strip one `a=rid:<rid> send` line and its simulcast reference from the SDP.
4. setLocalDescription with the munged offer to trigger the out-of-bounds write.
**How found:** Likely code review, possibly variant analysis of similar past bug CVE-2021-4079; unlikely found by fuzzing.
**Exploitation:** Zero-day exploited in the wild against Chrome users; exploit sample exists but flow not detailed in this text. Requires an app that permits SDP munging (common).
**Insight:** When an API reconciles two parallel collections (supported vs. current encodings), test mutating one side via a supported-but-uncommon path like SDP munging so lengths diverge; look at past similar bugs for variants.