CVE-2023-46048
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is...
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46048- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2023-50309
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
EUVD-2023-50309- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j569-gjjp-9rhp
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is...
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
GHSA-j569-gjjp-9rhp- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46048- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46048
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
DEBIAN-CVE-2023-46048- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1997
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
- Record
OESA-2024-1997- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 8 moreShow less
OSVOESA-2024-1998
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
- Record
OESA-2024-1998- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-1999
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
- Record
OESA-2024-1999- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-2000
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46051)
- Record
OESA-2024-2000- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-2001
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
- Record
OESA-2024-2001- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV No score
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46048- Updated
- 2026-11-02
OSVSUSE-SU-2024:1296-1 No score
Security update for texlive
This update for texlive fixes the following issues:
- CVE-2023-46048: Fixed null pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)
- Record
SUSE-SU-2024:1296-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1310-1 No score
Security update for texlive
This update for texlive fixes the following issues:
- CVE-2023-46048: Fixed NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)
- CVE-2023-46051: Fixed NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127)
- Record
SUSE-SU-2024:1310-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3628-1 No score
Security update for texlive
This update for texlive fixes the following issues:
- CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).
- CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).
- CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).
- Record
SUSE-SU-2026:3628-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
texlive-binDebian:12 |
All versions, plus listed versions 2022.20220321.62855-5.12022.20220321.62855-5.1+deb12u12022.20220321.62855-5.1+deb12u22022.20220321.62855-62022.20220321.62855-7 Show 27 moreShow less2022.20220321.62855-82023.20230311.66589-12023.20230311.66589-22023.20230311.66589-32023.20230311.66589-42023.20230311.66589-52023.20230311.66589-62023.20230311.66589-72023.20230311.66589-82023.20230311.66589-92024.20240313.70630+ds-12024.20240313.70630+ds-22024.20240313.70630+ds-32024.20240313.70630+ds-42024.20240313.70630+ds-52024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-42025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-binDebian:13 |
All versions, plus listed versions 2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-4 Show 7 moreShow less2025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-binDebian:14 |
All versions, plus listed versions 2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-4 Show 7 moreShow less2025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-baseopenEuler:22.03-LTS-SP3 |
before 20180414-38.oe2203sp3 | 20180414-38.oe2203sp3 |
texlive-baseopenEuler:20.03-LTS-SP4 |
before 20180414-33.oe2003sp4 | 20180414-33.oe2003sp4 |
texlive-baseopenEuler:22.03-LTS-SP1 |
before 20180414-38.oe2203sp1 | 20180414-38.oe2203sp1 |
texlive-baseopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 20210325-8.oe2403 | 20210325-8.oe2403 |
texlive-baseopenEuler:22.03-LTS-SP4 |
before 20180414-38.oe2203sp4 | 20180414-38.oe2203sp4 |
texliveSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2013.20130620-22.11.1 | 2013.20130620-22.11.1 |
texliveSUSE:Linux Enterprise Server 12 SP5 |
before 2013.20130620-22.11.1 | 2013.20130620-22.11.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
texliveSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2013.20130620-22.11.1 | 2013.20130620-22.11.1 |
texliveSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2021.20210325-150600.38.3.1 | 2021.20210325-150600.38.3.1 |
texliveSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 3 CVEs |
before 2021.20210325-150600.38.3.1 | 2021.20210325-150600.38.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46048 is a medium vulnerability (CVSS 6.2) in Tug Tex Live, published March 27, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in texlive-base 20180414-38.oe2203sp3.
References
tug.org/pipermail/tex-live/2023-August/049400.html
seclists.org/fulldisclosure/2024/Jan/65
packetstormsecurity.com/files/176819/tex-live-944e257-Null-Pointer.html
nvd.nist.gov/vuln/detail/CVE-2023-46048
github.com/advisories/GHSA-j569-gjjp-9rhp
security-tracker.debian.org/tracker/CVE-2023-46048
Show 15 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1997
suse.com/support/update/announcement/2024/suse-su-20241296-1
bugzilla.suse.com/1222126