CVE-2023-32281

Reference Links

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-143-04 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-23-143-04

Frequently Asked Questions

• What is CVE-2023-32281?

  CVE-2023-32281 is a vulnerability that allows an attacker to execute arbitrary code in the context of the current process by leveraging an out-of-bounds read in FontManager due to lack of proper validation of user-supplied data in the affected application.

• How severe is CVE-2023-32281?

  CVE-2023-32281 has a severity score of 7.8 out of 10, indicating a high severity vulnerability.

• Which software is affected by CVE-2023-32281?

  The software affected by CVE-2023-32281 includes Horner Automation Cscape version 9.90-sp8 and Hornerautomation Cscape Envisionrv version 4.70.

• How can an attacker exploit CVE-2023-32281?

  An attacker can exploit CVE-2023-32281 by providing malicious data in project files (e.g., CSP) to trigger an out-of-bounds read in FontManager, allowing them to execute arbitrary code in the current process.

• Is there a fix for CVE-2023-32281?

  At the time of writing, there is no specific fix available for CVE-2023-32281. It is recommended to follow any security advisories or patches provided by the vendor or product maintainers.