Audinate Dante Discovery mDNSResponder.exe DLL Sideloading and Privilege Escalation Vulnerability (CVE-2022-23748) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTWindows systems running Audinate Dante Discovery services and utilizing the mDNSResponder.exe component
Local attackers can leverage the legitimate, signed executable to load malicious DLLs, leading to arbitrary code execution with elevated privileges
Apply official security patches from Audinate, restrict write permissions on the mDNSResponder execution directory, and monitor for unauthorized DLL loads
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Refer to the official Audinate security advisory to update Dante Discovery to the latest secure version. Use the following PowerShell command to identify the service status and path.
# Verify the mDNSResponder service status and executable path
Get-WmiObject win32_service | Where-Object { $_.PathName -like '*mDNSResponder*' } | Select-Object Name, DisplayName, PathName, StartMode2. Temporary Workaround & Hardening Configuration
If patching cannot be immediately applied, restrict write permissions on the mDNSResponder.exe installation directory using Access Control Lists (ACLs) to prevent non-administrative users from dropping malicious DLLs.
:: Restrict write permissions on the Dante Discovery directory to Administrators and SYSTEM only
icacls 'C:\Program Files\Audinate\Dante Discovery' /inheritance:r /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-18:(OI)(CI)F /grant:r *S-1-5-32-545:(OI)(CI)RX3. Log Audit & IoC Verification Commands
Run the following PowerShell script to scan the application directory for unsigned or untrusted DLLs that may indicate a sideloading attempt.
# Scan the Dante Discovery directory for unsigned DLLs
$targetDir = 'C:\Program Files\Audinate\Dante Discovery'
if (Test-Path $targetDir) {
Get-ChildItem -Path $targetDir -Filter *.dll | ForEach-Object {
$signature = Get-AuthenticodeSignature $_.FullName
if ($signature.Status -ne 'Valid') {
Write-Warning 'Unsigned or untrusted DLL detected: ' + $_.FullName
} else {
Write-Output 'Legitimate signed DLL: ' + $_.FullName
}
}
} else {
Write-Host 'Dante Discovery directory not found.'
}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-23748) exists in the mDNSResponder.exe executable used by Audinate Dante Discovery and other integrations. The executable improperly specifies how to load dynamic link libraries (DLLs), failing to enforce secure absolute paths or safe DLL search order (CWE-426, CWE-114). Consequently, the application searches for required libraries in its execution directory or system search paths, allowing an attacker to place a malicious DLL in those locations.
2. Exploitation Mechanics & Attack Scenario
An attacker with local access or write permissions to the application directory places a crafted, malicious DLL with a name matching a dependency expected by mDNSResponder.exe. When the Dante Discovery service starts or the system reboots, the Windows loader prioritizes the local directory and loads the malicious DLL instead of the legitimate system library. Because the code runs under the context of a trusted, digitally signed process, it can bypass application whitelisting and Endpoint Detection and Response (EDR) solutions.
3. Infrastructure & Business Impact
As this vulnerability is actively exploited in the wild and listed in the CISA KEV catalog, it poses a severe threat to enterprise environments. Successful exploitation allows an attacker to escalate privileges from a standard user to SYSTEM level. This can serve as a critical stepping stone for lateral movement, credential dumping, and deploying ransomware across the corporate network.
Official Vendor Advisories & References
mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.
Frequently Asked SecOps Questions (CVE-2022-23748)
FAQQ1. How critical is CVE-2022-23748 and is it actively exploited in the wild?
CVE-2022-23748 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 8.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-23748?
Primary impacted vendors include audinate, apple across dante_discovery, mdnsresponder. Scope summary: Windows environments running Audinate Dante Discovery and utilizing mDNSResponder.exe (refer to vendor advisory for specific version details)
Q3. What temporary mitigations or workarounds exist for CVE-2022-23748 before patching?
[Mitigation] Apply official security patches from Audinate, restrict write permissions on the mDNSResponder execution directory, and monitor for unauthorized DLL loads Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-23748
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (audinate)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Apple iOS, macOS, and watchOS Memory Corruption Arbitrary Code Execution Vulnerability (CVE-2026-20700)
[Affected Scope] Apple devices running iOS before 26.3, iPadOS before 26.3, macOS Tahoe before 26.3, tvOS before 26.3, visionOS before 26.3, and watchOS before 26.3
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.