CVE-2023-46051
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE:...
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46051- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2023-50312
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
EUVD-2023-50312- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pjw3-8x26-xpwm
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE:...
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
GHSA-pjw3-8x26-xpwm- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46051- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46051
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
DEBIAN-CVE-2023-46051- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-2000
texlive-base security update
The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.
Security Fix(es):
Tex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46051)
- Record
OESA-2024-2000- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSV No score
TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.
- Record
CVE-2023-46051- Updated
- 2026-11-02
OSVSUSE-SU-2024:1310-1 No score
Security update for texlive
This update for texlive fixes the following issues:
- CVE-2023-46048: Fixed NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)
- CVE-2023-46051: Fixed NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127)
- Record
SUSE-SU-2024:1310-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3628-1 No score
Security update for texlive
This update for texlive fixes the following issues:
- CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).
- CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).
- CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).
- Record
SUSE-SU-2026:3628-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
texlive-binDebian:12 |
All versions, plus listed versions 2022.20220321.62855-5.12022.20220321.62855-5.1+deb12u12022.20220321.62855-5.1+deb12u22022.20220321.62855-62022.20220321.62855-7 Show 27 moreShow less2022.20220321.62855-82023.20230311.66589-12023.20230311.66589-22023.20230311.66589-32023.20230311.66589-42023.20230311.66589-52023.20230311.66589-62023.20230311.66589-72023.20230311.66589-82023.20230311.66589-92024.20240313.70630+ds-12024.20240313.70630+ds-22024.20240313.70630+ds-32024.20240313.70630+ds-42024.20240313.70630+ds-52024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-42025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-binDebian:13 |
All versions, plus listed versions 2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-4 Show 7 moreShow less2025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-binDebian:14 |
All versions, plus listed versions 2024.20240313.70630+ds-62025.20250727.75242+ds-12025.20250727.75242+ds-22025.20250727.75242+ds-32025.20250727.75242+ds-4 Show 7 moreShow less2025.20250727.75242+ds-52025.20250727.75242+ds-5~hurd.12026.20260303.78225+ds-12026.20260303.78225+ds-22026.20260303.78225+ds-32026.20260303.78225+ds-42026.20260303.78225+ds-5 |
None known |
texlive-baseopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 20210325-8.oe2403 | 20210325-8.oe2403 |
texliveSUSE:Linux Enterprise Module for Basesystem 15 SP5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveopenSUSE:Leap 15.5 From an advisory covering 2 CVEs |
before 2021.20210325-150400.31.6.4 | 2021.20210325-150400.31.6.4 |
texliveSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2021.20210325-150600.38.3.1 | 2021.20210325-150600.38.3.1 |
texliveSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 3 CVEs |
before 2021.20210325-150600.38.3.1 | 2021.20210325-150600.38.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46051 is a low vulnerability (CVSS 3.3) in texlive-bin, published March 27, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile.
References
tug.org/pipermail/tex-live/2023-August/049406.html
seclists.org/fulldisclosure/2024/Jan/68
packetstormsecurity.com/files/176822/tex-live-944e257-Null-Pointer.html
nvd.nist.gov/vuln/detail/CVE-2023-46051
github.com/advisories/GHSA-pjw3-8x26-xpwm
security-tracker.debian.org/tracker/CVE-2023-46051
Show 10 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2000
suse.com/support/update/announcement/2024/suse-su-20241310-1
bugzilla.suse.com/1222126