CVE-2023-43826: Apache Guacamole: Integer overflow in handling of VNC image buffers
First published: Tue Dec 19 2023(Updated: )
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes this issue.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <=1.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-43826?
CVE-2023-43826 is classified as a high-severity vulnerability due to its potential to cause memory corruption.
How do I fix CVE-2023-43826?
To fix CVE-2023-43826, upgrade Apache Guacamole to version 1.5.4 or later.
What software is affected by CVE-2023-43826?
CVE-2023-43826 affects Apache Guacamole versions up to and including 1.5.3.
What could happen if I connect to a compromised VNC server with CVE-2023-43826?
Connecting to a compromised VNC server could lead to memory corruption and potentially allow arbitrary code execution.
Is CVE-2023-43826 specific to any protocol?
Yes, CVE-2023-43826 specifically affects the VNC protocol used in Apache Guacamole.
- collector/oss-sec
- alias/CVE-2023-43826
- collector/mitre-cve
- agent/type
- agent/references
- agent/first-publish-date
- agent/title
- agent/severity
- agent/weakness
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- agent/trending
- vendor/apache
- canonical/apache guacamole
- version/apache guacamole/1.5.3