CVE-2023-49990
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable...
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
CVE-2023-49990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
CVE-2023-49990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-53885
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
EUVD-2023-53885- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x7cw-5x7j-jx35
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable...
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
GHSA-x7cw-5x7j-jx35- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVAZL-34674
CVE-2023-49990 affecting package espeak-ng for versions less than 1.51.1-1
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
AZL-34674- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSV
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
CVE-2023-49990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2023-49990
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
DEBIAN-CVE-2023-49990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-1021
espeak-ng security update
The eSpeak NG is a compact open source software text-to-speech synthesizer for Linux, Windows, Android and other operating systems. It supports 70 languages and accents. It is based on the eSpeak engine created by Jonathan Duddington.
Security Fix(es):
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.(CVE-2023-49990)
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.(CVE-2023-49991)
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.(CVE-2023-49992)
Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.(CVE-2023-49993)
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.(CVE-2023-49994)
- Record
OESA-2024-1021- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1057
espeak-ng security update
The eSpeak NG is a compact open source software text-to-speech synthesizer for Linux, Windows, Android and other operating systems. It supports 70 languages and accents. It is based on the eSpeak engine created by Jonathan Duddington.
Security Fix(es):
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.(CVE-2023-49990)
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.(CVE-2023-49991)
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.(CVE-2023-49992)
Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.(CVE-2023-49993)
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.(CVE-2023-49994)
- Record
OESA-2024-1057- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-49990
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- Record
UBUNTU-CVE-2023-49990- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2024-0249 No score
Updated espeak-ng packages fix security vulnerabilities
It was discovered that eSpeak NG did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
- Record
MGASA-2024-0249- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14230-1 No score
espeak-ng-1.51.1-1.1 on GA media
These are all security issues fixed in the espeak-ng-1.51.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14230-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2632-1 No score
Security update for espeak-ng
This update for espeak-ng fixes the following issues:
- CVE-2023-49990: Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c (bsc#1218010)
- CVE-2023-49991: Fixed stack-buffer-underflow exists in the function CountVowelPosition in synthdata.c (bsc#1218006)
- CVE-2023-49992: Fixed stack-buffer-overflow exists in the function RemoveEnding in dictionary.c (bsc#1218007)
- CVE-2023-49993: Fixed buffer overflow in ReadClause function at readclause.c (bsc#1218008)
- CVE-2023-49994: Fixed floating point exception in PeaksToHarmspect at wavegen.c (bsc#1218009)
- Record
SUSE-SU-2024:2632-1- Updated
- 2026-11-02
OSVUSN-6858-1 No score
espeak-ng vulnerabilities
It was discovered that eSpeak NG did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2023-49990, CVE-2023-49991, CVE-2023-49992, CVE-2023-49993, CVE-2023-49994)
- Record
USN-6858-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
espeak-ngAzure Linux:3 |
before 1.51.1-1 | 1.51.1-1 |
espeak-ngDebian:12 |
before 1.51+dfsg-10+deb12u1, plus listed versions 1.51+dfsg-10 |
1.51+dfsg-10+deb12u1 |
espeak-ngDebian:13 |
before 1.51+dfsg-12 | 1.51+dfsg-12 |
espeak-ngDebian:14 |
before 1.51+dfsg-12 | 1.51+dfsg-12 |
espeak-ngDebian:11 From an advisory covering 5 CVEs |
before 1.50+dfsg-7+deb11u2, plus listed versions 1.50+dfsg-71.50+dfsg-7+deb11u11.50+dfsg-7+deb11u1~bpo10+1 |
1.50+dfsg-7+deb11u2 |
espeak-ngMageia:9 From an advisory covering 5 CVEs |
before 1.51.1-1.1.mga9 | 1.51.1-1.1.mga9 |
espeak-ngopenEuler:20.03-LTS-SP1 From an advisory covering 5 CVEs |
before 1.51-2.oe1 | 1.51-2.oe1 |
espeak-ngopenEuler:20.03-LTS-SP3 From an advisory covering 5 CVEs |
before 1.51-2.oe1 | 1.51-2.oe1 |
espeak-ngopenEuler:20.03-LTS-SP4 From an advisory covering 5 CVEs |
before 1.51-2.oe2003sp4 | 1.51-2.oe2003sp4 |
espeak-ngopenEuler:22.03-LTS From an advisory covering 5 CVEs |
before 1.51-2.oe2203sp2 | 1.51-2.oe2203sp2 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
espeak-ngopenEuler:22.03-LTS-SP1 From an advisory covering 5 CVEs |
before 1.51-2.oe2203sp1 | 1.51-2.oe2203sp1 |
espeak-ngopenEuler:22.03-LTS-SP2 From an advisory covering 5 CVEs |
before 1.51-2.oe2203sp2 | 1.51-2.oe2203sp2 |
espeak-ngopenEuler:22.03-LTS-SP3 From an advisory covering 5 CVEs |
before 1.51-2.oe2203sp3 | 1.51-2.oe2203sp3 |
espeak-ngSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 From an advisory covering 5 CVEs |
before 1.50-150300.3.3.1 | 1.50-150300.3.3.1 |
espeak-ngSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 5 CVEs |
before 1.50-150300.3.3.1 | 1.50-150300.3.3.1 |
espeak-ngopenSUSE:Leap 15.5 From an advisory covering 5 CVEs |
before 1.50-150300.3.3.1 | 1.50-150300.3.3.1 |
espeak-ngopenSUSE:Leap 15.6 From an advisory covering 5 CVEs |
before 1.50-150300.3.3.1 | 1.50-150300.3.3.1 |
espeak-ngUbuntu:Pro:18.04:LTS |
before 1.49.2+dfsg-1ubuntu0.1~esm1, plus listed versions 1.49.1+dfsg-21.49.2+dfsg-1 |
1.49.2+dfsg-1ubuntu0.1~esm1 |
espeak-ngUbuntu:20.04:LTS |
before 1.50+dfsg-6ubuntu0.1, plus listed versions 1.49.2+dfsg-81.50+dfsg-41.50+dfsg-51.50+dfsg-6 |
1.50+dfsg-6ubuntu0.1 |
espeak-ngUbuntu:22.04:LTS |
before 1.50+dfsg-10ubuntu0.1, plus listed versions 1.50+dfsg-7build21.50+dfsg-81.50+dfsg-91.50+dfsg-10 |
1.50+dfsg-10ubuntu0.1 |
espeak-ngUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 1.49.2+dfsg-1ubuntu0.1~esm1, plus listed versions 1.49.1+dfsg-21.49.2+dfsg-1 |
1.49.2+dfsg-1ubuntu0.1~esm1 |
espeak-ngUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 1.50+dfsg-6ubuntu0.1, plus listed versions 1.49.2+dfsg-81.50+dfsg-41.50+dfsg-51.50+dfsg-6 |
1.50+dfsg-6ubuntu0.1 |
espeak-ngUbuntu:22.04:LTS From an advisory covering 5 CVEs |
before 1.50+dfsg-10ubuntu0.1, plus listed versions 1.50+dfsg-7build21.50+dfsg-81.50+dfsg-91.50+dfsg-10 |
1.50+dfsg-10ubuntu0.1 |
espeak-ngopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.51.1-1.1 | 1.51.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-49990 is a medium vulnerability (CVSS 5.3) in Espeak-ng, published December 12, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in espeak-ng 1.51.1-1.
References
github.com/espeak-ng/espeak-ng/issues/1824
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ
lists.debian.org/debian-lts-announce/2025/05/msg00050.html
Show 30 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-49990
security-tracker.debian.org/tracker/CVE-2023-49990
advisories.mageia.org/MGASA-2024-0249.html
bugs.mageia.org/show_bug.cgi?id=33348
ubuntu.com/security/notices/USN-6858-1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1021
suse.com/support/update/announcement/2024/suse-su-20242632-1
bugzilla.suse.com/1218006
cve.org/CVERecord?id=CVE-2023-49990