CVE-2023-52339

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or...

6.5 MediumFix available

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.10%Up 1.0 points since Jan 17, 2024

What each source reports

NVD Score used 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: CVE-2023-52339
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

CVE List 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: CVE-2023-52339
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2023-56996 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: EUVD-2023-56996
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vmjp-26xc-5h39 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or...

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: GHSA-vmjp-26xc-5h39
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: CVE-2023-52339
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2023-52339 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: DEBIAN-CVE-2023-52339
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-52339 6.5

In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. It may result in buffer overflows.

Record: UBUNTU-CVE-2023-52339
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:13588-1 No score

libebml-devel-1.4.5-2.1 on GA media

These are all security issues fixed in the libebml-devel-1.4.5-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:13588-1
Updated: 2026-11-02

OSVUSN-8746-1 No score

libebml vulnerability

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service.

Record: USN-8746-1
Updated: 2026-11-02

Affected products

matroska libebml

Affected packages

Affected packages
Package	Affected	Fixed
`libebml` Debian:12	before 1.4.4-1+deb12u1, plus listed versions 1.4.4-1	1.4.4-1+deb12u1
`libebml` Debian:13	before 1.4.5-1	1.4.5-1
`libebml` Debian:14	before 1.4.5-1	1.4.5-1
`libebml` Debian:11	before 1.4.2-1+deb11u1, plus listed versions 1.4.2-1	1.4.2-1+deb11u1
`libebml` Ubuntu:Pro:16.04:LTS	before 1.3.3-1ubuntu0.1+esm1, plus listed versions 1.3.1-51.3.3-11.3.3-1ubuntu0.1	1.3.3-1ubuntu0.1+esm1
`libebml` Ubuntu:Pro:18.04:LTS	before 1.3.5-2ubuntu0.1+esm1, plus listed versions 1.3.4-21.3.5-21.3.5-2ubuntu0.1	1.3.5-2ubuntu0.1+esm1
`libebml` Ubuntu:Pro:20.04:LTS	before 1.3.10-1ubuntu0.1~esm1, plus listed versions 1.3.9-21.3.10-11.3.10-1build1	1.3.10-1ubuntu0.1~esm1
`libebml` Ubuntu:Pro:22.04:LTS	before 1.4.2-2ubuntu0.1~esm1, plus listed versions 1.4.2-11.4.2-2	1.4.2-2ubuntu0.1~esm1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-52339 is a medium vulnerability (CVSS 6.5) in Matroska Libebml, published January 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in libebml 1.4.4-1+deb12u1.

References

Show 12 moreShow less