CVE-2023-36328

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit...

9.8 CriticalFix available

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.26%Up 1.2 points since Sep 2, 2023

What each source reports

NVD Score used 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE List 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2023-40296 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: EUVD-2023-40296
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j3xv-6967-cv88 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit...

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: GHSA-j3xv-6967-cv88
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVALPINE-CVE-2023-36328 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: ALPINE-CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVAZL-28627 9.8

CVE-2023-36328 affecting package tcl for versions less than 8.6.13-2

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: AZL-28627
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 13 moreShow less

OSVAZL-28639 9.8

CVE-2023-36328 affecting package libtommath for versions less than 1.1.0-5

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: AZL-28639
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-35296 9.8

CVE-2023-36328 affecting package tcl for versions less than 8.6.13-3

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: AZL-35296
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

OSVAZL-36959 9.8

CVE-2023-36328 affecting package libtommath for versions less than 1.1.0-5

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: AZL-36959
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-48187 9.8

CVE-2023-36328 affecting package samba 4.18.3-2

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: AZL-48187
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

OSV 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCVE-2025-40913 6.5

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow.

Net::Dropbear embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Record: CVE-2025-40913
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-1395
Updated: 2026-11-02

OSVCVE-2025-40914 9.8

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow.

CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

Record: CVE-2025-40914
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1395
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-36328 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: DEBIAN-CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2023-1625 9.8

libtommath security update

LibTomMath is a free open source portable number theoretic multiple-precision integer library written entirely in C. The library is designed to provide a simple to work with API that provides fairly efficient routines that build out of the box without configuration.

Security Fix(es):

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).(CVE-2023-36328)

Record: OESA-2023-1625
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-36328 9.8

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Record: UBUNTU-CVE-2023-36328
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2023-0265 No score

Updated libtommath packages fix security vulnerability

libtomath is vulnerable to an Integer Overflow vulnerability that could allow attackers to execute arbitrary code and cause a denial of service (DoS). (CVE-2023-36328)

Record: MGASA-2023-0265
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13425-1 No score

libtommath-devel-1.2.1-1.1 on GA media

These are all security issues fixed in the libtommath-devel-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13425-1
Updated: 2026-11-02

OSVUSN-6402-1 No score

libtommath vulnerability

It was discovered that LibTomMath incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code and cause a denial of service (DoS).

Record: USN-6402-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libtommath` Alpine:v3.23	before 1.2.1-r0	1.2.1-r0
`libtommath` Alpine:v3.24	before 1.2.1-r0	1.2.1-r0
`tcl` Azure Linux:2	before 8.6.13-2	8.6.13-2
`libtommath` Azure Linux:2	before 1.1.0-5	1.1.0-5
`tcl` Azure Linux:3	before 8.6.13-3	8.6.13-3
`libtommath` Azure Linux:3	before 1.1.0-5	1.1.0-5
`samba` Azure Linux:3	through 4.18.3-2	None known
`libtommath` Debian:12	before 1.2.0-6+deb12u1, plus listed versions 1.2.0-6	1.2.0-6+deb12u1
`libtommath` Debian:13	before 1.2.1-1	1.2.1-1
`libtommath` Debian:14	before 1.2.1-1	1.2.1-1

Show 12 moreShow less

Affected packages
Package	Affected	Fixed
`libtommath` Debian:11	before 1.2.0-6+deb11u1, plus listed versions 1.2.0-6	1.2.0-6+deb11u1
`libtommath` Mageia:8	before 1.2.1-1.mga8	1.2.1-1.mga8
`libtommath` Mageia:9	before 1.2.1-1.mga9	1.2.1-1.mga9
`libtommath` openEuler:20.03-LTS-SP1	before 1.1.0-4.oe1	1.1.0-4.oe1
`libtommath` openEuler:20.03-LTS-SP3	before 1.1.0-4.oe1	1.1.0-4.oe1
`libtommath` openEuler:22.03-LTS	before 1.2.0-4.oe2203sp2	1.2.0-4.oe2203sp2
`libtommath` openEuler:22.03-LTS-SP1	before 1.2.0-4.oe2203sp1	1.2.0-4.oe2203sp1
`libtommath` openEuler:22.03-LTS-SP2	before 1.2.0-4.oe2203sp2	1.2.0-4.oe2203sp2
`libtommath` Ubuntu:Pro:16.04:LTS	before 0.42.0-1.2ubuntu0.1~esm1, plus listed versions 0.42.0-1.2	0.42.0-1.2ubuntu0.1~esm1
`libtommath` Ubuntu:Pro:18.04:LTS	before 1.0.1-1ubuntu0.1~esm1, plus listed versions 1.0-41.0.1-1	1.0.1-1ubuntu0.1~esm1
`libtommath` Ubuntu:20.04:LTS	before 1.2.0-3ubuntu0.1, plus listed versions 1.1.0-31.2.0-11.2.0-21.2.0-3	1.2.0-3ubuntu0.1
`libtommath` Ubuntu:22.04:LTS	before 1.2.0-6ubuntu0.22.04.1, plus listed versions 1.2.0-6build11.2.0-6build21.2.0-6build3	1.2.0-6ubuntu0.22.04.1

History

History
Recorded	Changed	Sources
Nov 5, 2026	facts	OSV
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-36328 is a critical vulnerability (CVSS 9.8) in Libtom Libtommath, published September 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in libtommath 1.2.1-r0.

References

Show 25 moreShow less