CVE-2023-43826
Apache Guacamole: Integer overflow in handling of VNC image buffers
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Guacamole: Integer overflow in handling of VNC image buffers
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
CVE-2023-43826- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2023-48191
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
EUVD-2023-48191- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhj4-xc5f-6f87
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC...
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
GHSA-hhj4-xc5f-6f87- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
CVE-2023-43826- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Apache Guacamole: Integer overflow in handling of VNC image buffers
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
CVE-2023-43826- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-43826
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
UBUNTU-CVE-2023-43826- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-guacamole-2023-43826 No score
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
BIT-guacamole-2023-43826- Updated
- 2026-11-02
OSVBIT-guacamole-server-2023-43826 No score
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Record
BIT-guacamole-server-2023-43826- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
guacamoleBitnami |
before 1.5.3 | 1.5.3 |
guacamole-serverBitnami |
before 1.5.3 | 1.5.3 |
guacamole-clientUbuntu:16.04:LTS |
All versions, plus listed versions 0.8.3-1.10.8.3-1.2 |
None known |
guacamole-clientUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.9+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-43826 is a high vulnerability (CVSS 7.5) in Apache Guacamole, published December 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in guacamole 1.5.3.
References
lists.apache.org/thread/23gzwftpfgtq97tj6ttmbclry53kmwv6
openwall.com/lists/oss-security/2023/12/19/4
nvd.nist.gov/vuln/detail/CVE-2023-43826
github.com/advisories/GHSA-hhj4-xc5f-6f87
ubuntu.com/security/CVE-2023-43826
cve.org/CVERecord?id=CVE-2023-43826