Dante Discovery CVE-2022-23748: DLL Sideloading in KEV

What to do

1. Ask the vendors of any Windows audio, AV or conferencing software that uses the Dante Application Library whether their build ships mDNSResponder.exe 1.3.2 or later, and install their update.
2. Search Windows endpoints for mDNSResponder.exe outside the install folders you expect, especially in user-writable paths.
3. Alert on any file named dal_keepalives.dll and on signed binaries that run from user profile, temp or ProgramData folders.
4. Use application control (WDAC or AppLocker) to restrict where signed third-party executables may run from.

How to check if you are affected or compromised

• Run a PowerShell search for mDNSResponder.exe and dal_keepalives.dll across endpoints and investigate any copy outside a legitimate product directory.
• Review EDR telemetry for mDNSResponder.exe loading a DLL from its own folder when that folder is not a known install path.
• Treat a confirmed hit as a malware infection: the DLL is the payload, so isolate the host and investigate how both files arrived.

What happened#

In late 2022, Check Point Research found malware using a DLL sideloading trick during an investigation of a targeted attack. Its CPR-Zero entry, reported to the vendor on October 28 and published on November 16, 2022, describes what the attacker did. They downloaded two files into the same folder on infected machines. One was mDNSResponder.exe, a validly signed executable that Check Point says ships with Zoom's product installation, including Zoom Rooms. The other was dal_keepalives.dll, a malicious DLL written by the attackers. When the signed executable ran, it loaded the attacker's DLL from its own folder.

The executable comes from Audinate's Dante Application Library for Windows, a component that third-party audio and conferencing products embed. The CVE record, published November 17, 2022, says it "improperly specifies how to load the DLL, from which folder and under what conditions" (CWE-114). NVD scores it CVSS 3.1 7.8, with a local attack vector and user interaction required.

More than two years later, on February 6, 2025, CISA added it to the KEV catalog "based on evidence of active exploitation", alongside a 7-Zip and an Outlook flaw. CISA did not say why it was added in 2025. Check Point's 2022 entry already documented in-the-wild use. We found no later public report of a new campaign as of October 23, 2026. Ransomware use is listed as unknown.

Who is affected#

Audinate's response, dated December 7, 2022, says the bug affects third-party products that use Dante Application Library for Windows 1.2.0 and earlier, which ship mDNSResponder.exe 1.3.1 and earlier. It does not affect other Dante hardware or software that includes a file of the same name. Audinate shipped mDNSResponder.exe 1.3.2 in library 1.2.1 and as a standalone patch, both delivered through the third-party vendors. Audinate also says "it is not possible to remotely exploit this vulnerability."

Do you really need to act?#

Not urgently. The important detail is that the attacker brought the vulnerable signed executable with them. Updating the copies you have installed does not stop someone from dropping an old signed copy next to a malicious DLL. The bug matters as a way to make malware look legitimate, not as a way in. An attacker must already be able to write files and start a process on the machine. So this is a detection problem more than a patching one. Update Dante-based software through its vendor during normal maintenance, and make sure your endpoint tools catch signed binaries running from odd places.

What to do now#

1. Ask the vendors of Windows audio, AV or conferencing tools built on the Dante Application Library whether they ship mDNSResponder.exe 1.3.2 or later, and apply their update.
2. Find every copy on a host: Get-ChildItem C:\ -Recurse -Include mDNSResponder.exe,dal_keepalives.dll -ErrorAction SilentlyContinue | Select FullName, @{n='Ver';e={$_.VersionInfo.FileVersion}}.
3. Alert on any dal_keepalives.dll and on signed executables running from user profile, temp or ProgramData folders.
4. Use WDAC or AppLocker rules that limit where signed third-party executables may run.

How to tell if you were hit#

Look for mDNSResponder.exe in a folder that is not a legitimate product install path, especially with dal_keepalives.dll beside it. Check EDR process and image-load events for that executable loading a DLL from its own directory. Check Point did not publish hashes, payload behavior or attribution. A confirmed hit means the host ran attacker code. Isolate it and investigate how both files arrived.

Timeline#

• Oct 28, 2022 — Check Point reports the issue after investigating a targeted attack.
• Nov 16, 2022 — Check Point publishes its CPR-Zero entry.
• Nov 17, 2022 — CVE-2022-23748 is published.
• Dec 7, 2022 — Audinate publishes its response and the fixed mDNSResponder.exe 1.3.2.
• Feb 6, 2025 — CISA adds the CVE to KEV, with a February 27 deadline.

Vulnerability records

• CVE-2022-23748 · KEV 2025-02-06 · mDNSResponder.exe is vulnerable to DLL Sideloading attack.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Audinate — Response to Dante Discovery (mDNSResponder.exe) Security Issue (CVE-2022-23748) support.getdante.com
2. Check Point Research — CPR-Zero CVE-2022-23748 (CPR-ID 2193) cpr-zero.checkpoint.com
3. CVE record — CVE-2022-23748 cve.org
4. NVD — CVE-2022-23748 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2022-23748 cisa.gov
6. CISA — CISA Adds Five Known Exploited Vulnerabilities to Catalog (Feb 6, 2025) cisa.gov