CVE-2023-43826CWE-190

Apache Guacamole: Integer overflow in handling of VNC image buffers

High · published December 19, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.

Users are recommended to upgrade to version 1.5.4, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2023-12-19T19:50Z
EPSS history
Timeline
  • 19 DEC 19:50Z
    Apache Guacamole: Integer overflow in handling of VNC image buffers
    cvelistv5