{"id":"CVE-2023-45897","aliases":["ALSA-2024:2437","CLSA-2026-1779895093","DEBIAN-CVE-2023-45897","DLA-3861-1","EUVD-2023-50160","GHSA-5qgg-v88w-rgh6","MGASA-2024-0166","RHSA-2024:2437","RLSA-2024:2437","SUSE-SU-2023:4449-1","UBUNTU-CVE-2023-45897","USN-6970-1"],"status":"published","title":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00402,"percentile":0.34812,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-10-28T00:00:00Z","modified":"2026-10-29T11:31:08Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"exfatprogs","fixed_in":["1.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"exfatprogs","fixed_in":["1.1.3-3.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"exfatprogs","fixed_in":["1.2.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"exfatprogs","fixed_in":["1.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"exfatprogs","fixed_in":["1.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"exfatprogs","fixed_in":["1.1.0-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"exfatprogs","fixed_in":["1.2.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs","fixed_in":["0:1.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs-debuginfo","fixed_in":["0:1.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs-debugsource","fixed_in":["0:1.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"exfatprogs","fixed_in":["0:1.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"exfatprogs","fixed_in":["1.0.4-150300.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"exfatprogs","fixed_in":["1.0.4-150300.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"exfatprogs","fixed_in":["1.0.4-150300.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"exfatprogs","fixed_in":["1.0.4-150300.3.12.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"exfatprogs","fixed_in":["1.1.3-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-3.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1"}]}],"versions":["1.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1+deb11u1"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"exfatprogs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150300.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150300.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150300.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-150300.3.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-1ubuntu0.1"}]}],"versions":["1.1.0-1","1.1.2-2","1.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"exfatprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-1ubuntu0.1"}]}],"versions":["1.1.0-1","1.1.2-2","1.1.3-1"]}],"products":[{"vendor":"namjaejeon","product":"exfatprogs"}],"references":[{"url":"https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4","tags":["x_transferred","Patch","fix"]},{"url":"https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae","tags":["x_transferred","Patch","fix"]},{"url":"https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/","tags":["x_transferred","Exploit","Third Party Advisory","web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00003.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45897","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5qgg-v88w-rgh6"},{"url":"https://access.redhat.com/errata/RHSA-2024:2437","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2246976","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2437.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779895093.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45897.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45897","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0166.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33168","tags":["report"]},{"url":"https://lwn.net/Articles/971707/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246976","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-15865","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7945","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2437.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45897","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2437","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234449-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216701","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45897","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-45897","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6970-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45897","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T00:00:00Z","modified":"2024-09-05T14:53:21.13Z","updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-50160","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T00:00:00Z","modified":"2024-09-05T14:53:21Z","updated_at":"2026-11-03T00:56:03.195853Z"}],"ghsa":[{"id":"GHSA-5qgg-v88w-rgh6","title":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T21:30:24Z","modified":"2023-11-08T15:30:33Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:55.524004Z"}],"nvd":[{"id":"CVE-2023-45897","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T21:15:07.577Z","modified":"2026-06-17T06:29:44.947Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"DEBIAN-CVE-2023-45897","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T21:15:07.577Z","modified":"2026-10-26T18:02:35.023182258Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"RHSA-2024:2437","title":"Red Hat Security Advisory: exfatprogs security update","status":"published","published":"2024-09-16T15:44:56Z","modified":"2026-03-18T11:33:45.402007Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2437","title":"Moderate: exfatprogs security update","description":"The exfatprogs package contains utilities for formatting and repairing exFAT filesystems.\n\nSecurity Fix(es):\n\n* exfatprogs: exfatprogs allows out-of-bounds memory access (CVE-2023-45897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:03.633594Z","modified":"2025-10-07T17:40:31.274124Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-45897","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T21:15:00Z","modified":"2026-02-04T03:20:06.70888Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2437","title":"Moderate: exfatprogs security update","description":"The exfatprogs package contains utilities for formatting and repairing exFAT filesystems.\n\nSecurity Fix(es):\n\n* exfatprogs: exfatprogs allows out-of-bounds memory access (CVE-2023-45897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:08.668507716Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1779895093","title":"exfatprogs: Fix of CVE-2023-45897","description":"- CVE-2023-45897: fix out-of-bounds write in read_file_dentry_set when\n  SecondaryCount exceeds the maximum number of File Name entries","status":"published","published":"2026-05-27T15:18:17Z","modified":"2026-10-26T09:30:04.86844983Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CVE-2023-45897","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.","status":"published","published":"2023-10-28T00:00:00Z","modified":"2026-10-28T10:39:08.577882009Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DLA-3861-1","title":"exfatprogs - security update","status":"published","published":"2024-09-02T00:00:00Z","modified":"2026-03-09T01:20:12.666469Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0166","title":"Updated exfatprogs packages fix security vulnerability","description":"exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in\nread_file_dentry_set. (CVE-2023-45897)\n","status":"published","published":"2024-05-09T02:40:29Z","modified":"2026-04-16T04:42:33.006776682Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2023:4449-1","title":"Security update for exfatprogs","description":"This update for exfatprogs fixes the following issues:\n\n- CVE-2023-45897: Fixed out-of-bound memory issues in fsck (bsc#1216701).\n","status":"published","published":"2023-11-15T09:44:58Z","modified":"2026-02-04T02:26:36.214945Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6970-1","title":"exfatprogs vulnerability","description":"It was discovered that exfatprogs incorrectly handled certain memory\noperations. If a user or automated system were tricked into handling\nspecially crafted exfat partitions, a remote attacker could use this issue\nto cause exfatprogs to crash, resulting in a denial of service, or possibly\nexecute arbitrary code.\n","status":"published","published":"2024-08-20T13:03:07Z","modified":"2026-02-10T04:45:02Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}