Every CVE Search/ Get API key

CVE-2023-52389

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer...

9.8 CriticalFix available

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.85%Up 0.8 points since Jan 31, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
CVE-2023-52389
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
CVE List 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
CVE-2023-52389
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2023-57045 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
EUVD-2023-57045
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-3g75-6vfp-4hm3 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer...

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
GHSA-3g75-6vfp-4hm3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSV 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
CVE-2023-52389
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-52389 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
DEBIAN-CVE-2023-52389
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2026-3963 9.8

poco security update

This is ROS melodic ros_comm's 3rdparty poco.

Security Fix(es):

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.(CVE-2023-52389)

Record
OESA-2026-3963
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3964 9.8

poco security update

This is ROS melodic ros_comm's 3rdparty poco.

Security Fix(es):

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.(CVE-2023-52389)

Record
OESA-2026-3964
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3965 9.8

poco security update

This is ROS melodic ros_comm's 3rdparty poco.

Security Fix(es):

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.(CVE-2023-52389)

Record
OESA-2026-3965
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-52389 9.8

UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.

Record
UBUNTU-CVE-2023-52389
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15322-1 No score

libPocoActiveRecord112-1.14.2-1.1 on GA media

These are all security issues fixed in the libPocoActiveRecord112-1.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15322-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
poco
Debian:12
 before 1.11.0-3+deb12u1, plus listed versions
1.11.0-3
1.11.0-3+deb12u1
poco
Debian:13
 before 1.13.0-6
1.13.0-6
poco
Debian:14
 before 1.13.0-6
1.13.0-6
poco
Debian:11
 before 1.10.0-6+deb11u2, plus listed versions
1.10.0-61.10.0-6+deb11u1
1.10.0-6+deb11u2
poco
openEuler:24.03-LTS-SP1
 before 1.12.5p2-2.oe2403sp1
1.12.5p2-2.oe2403sp1
poco
openEuler:24.03-LTS-SP3
 before 1.12.5p2-3.oe2403sp3
1.12.5p2-3.oe2403sp3
poco
openEuler:22.03-LTS-SP4
 before 1.10.1-3.oe2203sp4
1.10.1-3.oe2203sp4
poco
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.3.6p1-41.3.6p1-4+deb7u1build1
 None known
poco
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.3.6p1-5.11.3.6p1-5.1build11.3.6p1-5.1ubuntu0.1
 None known
poco
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.7.8+dfsg1-21.7.8+dfsg1-31.8.0.1-1ubuntu4
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
poco
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.9.2-3ubuntu21.9.2-3ubuntu3
 None known
poco
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.10.0-61.11.0-3
 None known
poco
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.11.0-31.11.0-41.11.0-4.11.11.0-4.1build11.11.0-4.1build2
 None known
poco
Ubuntu:25.10
 All versions, plus listed versions
1.13.0-6build2
 None known
poco
Ubuntu:26.10
 All versions, plus listed versions
1.14.2-31.14.2-61.14.2-6ubuntu11.14.2-6ubuntu2
 None known
poco
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.13.0-6build21.14.2-3
 None known
poco
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.14.2-1.1
1.14.2-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-52389 is a critical vulnerability (CVSS 9.8) in Pocoproject Poco, published January 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in poco 1.11.0-3+deb12u1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open