---
title: "Dante Discovery CVE-2022-23748: DLL Sideloading in KEV"
url: https://erroneo.us/security/briefs/dante-discovery-cve-2022-23748-dll-sideloading/
description: "A 2022 DLL sideloading flaw in Audinate's mDNSResponder.exe, used by malware as a loader, joined KEV in 2025. Update Dante-based apps; hunt for the pattern."
type: security-brief
section: "Security Digest"
date_published: 2022-11-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2022-23748"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Dante Discovery CVE-2022-23748: DLL Sideloading in KEV

**Verdict: Most can relax.** This is a local DLL sideloading bug that attackers used as a malware loader by bringing their own copy of the signed executable, so patching changes little; update Dante-based apps when convenient and make sure your endpoint tooling flags the pattern.

- **Who must act:** Windows fleets running third-party audio or conferencing software built on the Dante Application Library for Windows 1.2.0 or earlier, and defenders who hunt for signed-binary abuse.
- **Who can relax:** Everyone else; the flaw is not remotely exploitable and Audinate says it does not affect other Dante hardware or software that ships an mDNSResponder.exe.
- **Affected:** Dante Application Library for Windows 1.2.0 and earlier (mDNSResponder.exe 1.3.1 and earlier), as bundled in third-party products
- **Fixed:** Dante Application Library for Windows 1.2.1 (mDNSResponder.exe 1.3.2); Standalone mDNSResponder.exe 1.3.2 patch for library 1.2.0 and earlier, distributed through third-party vendors
- **CVEs:** CVE-2022-23748
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Ask the vendors of any Windows audio, AV or conferencing software that uses the Dante Application Library whether their build ships mDNSResponder.exe 1.3.2 or later, and install their update.
2. Search Windows endpoints for mDNSResponder.exe outside the install folders you expect, especially in user-writable paths.
3. Alert on any file named dal_keepalives.dll and on signed binaries that run from user profile, temp or ProgramData folders.
4. Use application control (WDAC or AppLocker) to restrict where signed third-party executables may run from.

### How to check if you are affected

- Run a PowerShell search for mDNSResponder.exe and dal_keepalives.dll across endpoints and investigate any copy outside a legitimate product directory.
- Review EDR telemetry for mDNSResponder.exe loading a DLL from its own folder when that folder is not a known install path.
- Treat a confirmed hit as a malware infection: the DLL is the payload, so isolate the host and investigate how both files arrived.

## What happened

In late 2022, Check Point Research found malware using a DLL sideloading trick during an investigation of a targeted attack. Its [CPR-Zero entry](https://cpr-zero.checkpoint.com/vulns/cprid-2193/), reported to the vendor on October 28 and published on November 16, 2022, describes what the attacker did. They downloaded two files into the same folder on infected machines. One was `mDNSResponder.exe`, a validly signed executable that Check Point says ships with Zoom's product installation, including Zoom Rooms. The other was `dal_keepalives.dll`, a malicious DLL written by the attackers. When the signed executable ran, it loaded the attacker's DLL from its own folder.

The executable comes from Audinate's Dante Application Library for Windows, a component that third-party audio and conferencing products embed. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-23748), published November 17, 2022, says it "improperly specifies how to load the DLL, from which folder and under what conditions" (CWE-114). [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-23748) scores it CVSS 3.1 7.8, with a local attack vector and user interaction required.

More than two years later, on February 6, 2025, CISA [added it](https://www.cisa.gov/news-events/alerts/2025/02/06/cisa-adds-five-known-exploited-vulnerabilities-catalog) to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23748) "based on evidence of active exploitation", alongside a 7-Zip and an Outlook flaw. CISA did not say why it was added in 2025. Check Point's 2022 entry already documented in-the-wild use. We found no later public report of a new campaign as of October 23, 2026. Ransomware use is listed as unknown.

## Who is affected

[Audinate's response](https://support.getdante.com/hc/en-gb/articles/5508274386975-Audinate-Response-to-Dante-Discovery-mDNSResponder-exe-Security-Issue-CVE-2022-23748), dated December 7, 2022, says the bug affects third-party products that use Dante Application Library for Windows 1.2.0 and earlier, which ship `mDNSResponder.exe` 1.3.1 and earlier. It does not affect other Dante hardware or software that includes a file of the same name. Audinate shipped `mDNSResponder.exe` 1.3.2 in library 1.2.1 and as a standalone patch, both delivered through the third-party vendors. Audinate also says "it is not possible to remotely exploit this vulnerability."

## Do you really need to act?

Not urgently. The important detail is that the attacker brought the vulnerable signed executable with them. Updating the copies you have installed does not stop someone from dropping an old signed copy next to a malicious DLL. The bug matters as a way to make malware look legitimate, not as a way in. An attacker must already be able to write files and start a process on the machine. So this is a detection problem more than a patching one. Update Dante-based software through its vendor during normal maintenance, and make sure your endpoint tools catch signed binaries running from odd places.

## What to do now

1. Ask the vendors of Windows audio, AV or conferencing tools built on the Dante Application Library whether they ship `mDNSResponder.exe` 1.3.2 or later, and apply their update.
2. Find every copy on a host: `Get-ChildItem C:\ -Recurse -Include mDNSResponder.exe,dal_keepalives.dll -ErrorAction SilentlyContinue | Select FullName, @{n='Ver';e={$_.VersionInfo.FileVersion}}`.
3. Alert on any `dal_keepalives.dll` and on signed executables running from user profile, temp or ProgramData folders.
4. Use WDAC or AppLocker rules that limit where signed third-party executables may run.

## How to tell if you were hit

Look for `mDNSResponder.exe` in a folder that is not a legitimate product install path, especially with `dal_keepalives.dll` beside it. Check EDR process and image-load events for that executable loading a DLL from its own directory. Check Point did not publish hashes, payload behavior or attribution. A confirmed hit means the host ran attacker code. Isolate it and investigate how both files arrived.

## Timeline

- Oct 28, 2022 — Check Point reports the issue after investigating a targeted attack.
- Nov 16, 2022 — Check Point publishes its CPR-Zero entry.
- Nov 17, 2022 — CVE-2022-23748 is published.
- Dec 7, 2022 — Audinate publishes its response and the fixed `mDNSResponder.exe` 1.3.2.
- Feb 6, 2025 — CISA adds the CVE to KEV, with a February 27 deadline.

## Sources

1. [Audinate — Response to Dante Discovery (mDNSResponder.exe) Security Issue (CVE-2022-23748)](https://support.getdante.com/hc/en-gb/articles/5508274386975-Audinate-Response-to-Dante-Discovery-mDNSResponder-exe-Security-Issue-CVE-2022-23748)
2. [Check Point Research — CPR-Zero CVE-2022-23748 (CPR-ID 2193)](https://cpr-zero.checkpoint.com/vulns/cprid-2193/)
3. [CVE record — CVE-2022-23748](https://www.cve.org/CVERecord?id=CVE-2022-23748)
4. [NVD — CVE-2022-23748](https://nvd.nist.gov/vuln/detail/CVE-2022-23748)
5. [CISA — Known Exploited Vulnerabilities: CVE-2022-23748](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-23748)
6. [CISA — CISA Adds Five Known Exploited Vulnerabilities to Catalog (Feb 6, 2025)](https://www.cisa.gov/news-events/alerts/2025/02/06/cisa-adds-five-known-exploited-vulnerabilities-catalog)

---
Source page: https://erroneo.us/security/briefs/dante-discovery-cve-2022-23748-dll-sideloading/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt