CVE-2023-46052
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode...
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
CVE-2023-46052- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
CVE List No score
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
CVE-2023-46052- Updated
- 2026-11-02
EUVDEUVD-2023-50313 No score
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
EUVD-2023-50313- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-86vw-c532-f7g7
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode...
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
GHSA-86vw-c532-f7g7- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSV
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
CVE-2023-46052- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46052
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.
- Record
DEBIAN-CVE-2023-46052- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1590
sane-backends security update
SANE (Scanner Access Now Easy) is a sane and simple interface to both local and networked scanners and other image acquisition devices like digital still and video cameras.
Security Fix(es):
An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the sanei_configure_attach() function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file.(CVE-2023-46047)
Sane 1.2.1 heap bounds overwrite in init_options() from backend/test.c via a long init_mode string in a configuration file. NOTE: this is disputed because there is no expectation that test.c code should be executed with an attacker-controlled configuration file.(CVE-2023-46052)
- Record
OESA-2024-1590- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sane-backendsDebian:12 |
All versions, plus listed versions 1.2.1-21.2.1-31.2.1-41.2.1-51.2.1-6 Show 8 moreShow less1.2.1-71.3.0-11.3.0-21.3.1-11.3.1-21.3.1-31.3.1-41.4.0-1 |
None known |
sane-backendsDebian:13 |
All versions, plus listed versions 1.3.1-31.3.1-41.4.0-1 |
None known |
sane-backendsDebian:14 |
All versions, plus listed versions 1.3.1-31.3.1-41.4.0-1 |
None known |
sane-backendsopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.0.28-12.oe1 | 1.0.28-12.oe1 |
sane-backendsopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 1.0.28-12.oe2003sp4 | 1.0.28-12.oe2003sp4 |
sane-backendsopenEuler:22.03-LTS From an advisory covering 2 CVEs |
before 1.0.28-12.oe2203sp3 | 1.0.28-12.oe2203sp3 |
sane-backendsopenEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.0.28-12.oe2203sp1 | 1.0.28-12.oe2203sp1 |
sane-backendsopenEuler:22.03-LTS-SP2 From an advisory covering 2 CVEs |
before 1.0.28-12.oe2203sp2 | 1.0.28-12.oe2203sp2 |
sane-backendsopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 1.0.28-12.oe2203sp3 | 1.0.28-12.oe2203sp3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46052 is a high vulnerability (CVSS 7.1) in Sane-project Sane Backends, published March 27, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile.
References
gitlab.com/sane-project/backends/-/issues/709
seclists.org/fulldisclosure/2024/Jan/69
packetstormsecurity.com/files/176823/sane-1.2.1-Buffer-Overflow.html
nvd.nist.gov/vuln/detail/CVE-2023-46052
github.com/advisories/GHSA-86vw-c532-f7g7
security-tracker.debian.org/tracker/CVE-2023-46052
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1590