Xnview CVE-2023-46587

HIGH

Classic Buffer Overflow (CWE-120)

2023-10-27 cve@mitre.org

Buffer Overflow RCE Xnview

7.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 27, 2023 - 23:15 nvd

HIGH 7.8

DescriptionNVD

Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file.

AnalysisAI

Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file. Affected products include: Xnview.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.

More in Xnview

View all

CVE-2012-4988 CRITICAL Emergency POC

Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99

CVE-2013-2577 CRITICAL Act Now POC

Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file. Rated cr

CVE-2012-0276 MEDIUM This Month POC

Multiple heap-based buffer overflows in XnView before 1.99 allow remote attackers to cause a denial of service (applicat

CVE-2012-0282 MEDIUM This Month POC

Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash

CVE-2012-0277 MEDIUM This Month POC

Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash

CVE-2019-13262 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb. Rated high severity (CVSS 7.8), this

CVE-2019-13261 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384. Rated high severity (CVSS 7.8), this

CVE-2019-13260 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07. Rated high severity (CVSS 7.8), this

CVE-2019-13259 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566. Rated high severity (CVSS 7.8), this

CVE-2019-13258 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165. Rated high severity (CVSS 7.8), this

CVE-2019-13257 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa. Rated high severity (CVSS 7.8), this

CVE-2019-13256 HIGH This Week POC

XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e849. Rated high severity (CVSS 7.8), this

Same weakness CWE-120 – Classic Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2016-10174 CRITICAL POC

CVE-2016-0099 HIGH POC

CVE-2016-6366 HIGH POC

CVE-2013-1331 HIGH

CVE-2013-0641 HIGH

CVE-2017-15222 CRITICAL POC

CVE-2012-2763 HIGH POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2017-11882 HIGH POC

CVE-2010-3333 HIGH POC

Share

CVE-2023-46587 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy