CVE-2022-30055

Prime95 (a distributed-computing/stress-testing application) build 30.7 build 9 has a buffer overflow that could lead to remote code execution. The record is sparse on the trigger mechanics, so we read it at face value: a memory-corruption flaw in the application that, per the CVSS vector, is remotely reachable, unauthenticated, and needs no interaction, with the potential to run attacker code on the host running Prime95.

The context that tempers this is what Prime95 is and where it runs: it's a niche client application, typically found on enthusiast and benchmarking machines rather than in enterprise fleets or on internet-facing servers. So while the vector reads as critical, the real-world population of exposed, reachable installs is small and unusual, and this isn't the kind of ubiquitous server component that mass scanners chase. The severity label outruns the likely deployment footprint for most organizations.

Our approach is inventory-driven proportionality. In a typical enterprise estate Prime95 either isn't present or shows up on a handful of engineering or QA benchmarking boxes, so the task is confirming whether it exists at all and, if so, updating those few hosts and checking they aren't needlessly network-reachable. We rank it low for most environments not because the bug is weak but because the affected software is uncommon and rarely exposed — attention here scales with actual presence, which for most of us is near zero.