{"id":"CVE-2023-33865","aliases":["DEBIAN-CVE-2023-33865","DLA-3501-1","DLA-3987-1","EUVD-2023-38015","GHSA-h6fr-rh94-prmv","UBUNTU-CVE-2023-33865","openSUSE-SU-2023:0253-1","openSUSE-SU-2024:12986-1"],"status":"published","title":"RenderDoc through 1.26 allows local privilege escalation via a symlink attack.","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00898,"percentile":0.5987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2023-06-07T00:00:00Z","modified":"2026-11-03T07:05:10Z","fixes":[{"ecosystem":"Debian:12","package":"renderdoc","fixed_in":["1.24+dfsg-1+deb12u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24+dfsg-1+deb12u1"}]}],"versions":["1.24+dfsg-1"]},{"source":"osv","ecosystem":"Debian:10","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2+dfsg-2+deb10u1"}]}],"versions":["1.2+dfsg-2"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11+dfsg-5+deb11u1"}]}],"versions":["1.11+dfsg-5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4+dfsg-1","1.5+dfsg-1","1.5+dfsg-2","1.6+dfsg-1","1.6+dfsg-1build1","1.6+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11+dfsg-5","1.15+dfsg-1","1.16+dfsg-1","1.16+dfsg-1build1","1.18+dfsg-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-bp155.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-bp155.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"renderdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27-1.1"}]}],"bundled":3}],"products":[{"vendor":"renderdoc","product":"renderdoc"}],"references":[{"url":"https://renderdoc.org/","tags":["x_transferred","Product","web","report"]},{"url":"https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txt","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"http://seclists.org/fulldisclosure/2023/Jun/2","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory","article"]},{"url":"http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html","tags":["mailing-list","x_transferred","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202311-10","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33865","tags":["advisory"]},{"url":"https://renderdoc.org"},{"url":"https://github.com/advisories/GHSA-h6fr-rh94-prmv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33865.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-33865","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-33865","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/06/06/3","tags":["report"]},{"url":"https://github.com/baldurk/renderdoc/commit/601ed56111ce3803d8476d438ade1c92d6092856","tags":["report"]},{"url":"https://github.com/baldurk/renderdoc/commit/e0464fea4f9a7f149c4ee1d84e5ac57839a4a862","tags":["report"]},{"url":"https://github.com/baldurk/renderdoc/commit/1f72a09e3b4fd8ba45be4b0db4889444ef5179e2","tags":["report"]},{"url":"https://github.com/baldurk/renderdoc/commit/203fc8382a79d53d2035613d9425d966b1d4958e","tags":["report"]},{"url":"https://github.com/baldurk/renderdoc/commit/771aa8e769b72e6a36b31d6e2116db9952dcbe9b","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-33865","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OUXFQKIACDXNDNRMXVBF6QD6SJQYGXBM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212086","tags":["report"]},{"url":"https://bugzilla.suse.com/1212088","tags":["report"]},{"url":"https://bugzilla.suse.com/1212089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-33863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-33864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-33865","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-33865","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T00:00:00Z","modified":"2025-11-03T21:48:47.645Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:35:34.170609Z"}],"euvd":[{"id":"EUVD-2023-38015","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T00:00:00Z","modified":"2025-11-03T21:48:47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-h6fr-rh94-prmv","title":"RenderDoc through 1.26 allows local privilege escalation via a symlink attack.","description":"RenderDoc through 1.26 allows local privilege escalation via a symlink attack.","status":"published","published":"2023-06-07T21:30:18Z","modified":"2025-11-04T00:31:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2023-33865","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T20:15:10.053Z","modified":"2026-06-17T06:02:23.97Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"CVE-2023-33865","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T00:00:00Z","modified":"2026-11-03T07:05:10.123171762Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:52:02.098855Z"},{"id":"DEBIAN-CVE-2023-33865","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T20:15:10.053Z","modified":"2026-10-26T18:02:29.033041758Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-33865","description":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","status":"published","published":"2023-06-07T20:15:00Z","modified":"2026-04-22T14:07:54.485349Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"DLA-3501-1","title":"renderdoc - security update","status":"published","published":"2023-07-25T00:00:00Z","modified":"2026-03-09T01:18:37.370994Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3987-1","title":"renderdoc - security update","status":"published","published":"2024-12-08T00:00:00Z","modified":"2026-03-09T01:19:12.423803Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2023:0253-1","title":"Security update for renderdoc","description":"This update for renderdoc fixes the following issues:\n\nSecurity issues fixed:\n\n* CVE-2023-33863: integer overflow to heap-based buffer overflow\n* CVE-2023-33864: integer underflow to heap-based buffer overflow\n* CVE-2023-33865: symlink vulnerability in /tmp/RenderDoc \n","status":"published","published":"2023-09-25T10:02:37Z","modified":"2026-02-04T04:20:40.949143Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12986-1","title":"renderdoc-1.27-1.1 on GA media","description":"These are all security issues fixed in the renderdoc-1.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:16:57.094227Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}