{"id":"CVE-2023-46045","aliases":["AZL-34237","AZL-34768","BELL-CVE-2023-46045","CLSA-2025-1753376162","CLSA-2026-1776698705","DEBIAN-CVE-2023-46045","EUVD-2023-50306","GHSA-xpmp-64jj-f5gg","JLSEC-2026-1276","OESA-2024-1209","ROOT-OS-ALPINE-320-CVE-2023-46045","SUSE-SU-2024:1351-1","SUSE-SU-2024:1351-2","UBUNTU-CVE-2023-46045","USN-6708-1","openSUSE-SU-2024:13761-1"],"status":"published","title":"Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE:...","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00811,"percentile":0.572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-01-30T05:58:23.101856Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"graphviz","fixed_in":["2.42.4-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"graphviz","fixed_in":["2.42.4-12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-devel","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-doc","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-gd","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-graphs","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-java","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-lua","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-ocaml","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-perl","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-python3","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-ruby","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-tcl","fixed_in":["2.44.0-25.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-devel","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-doc","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-gd","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-graphs","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-java","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-lua","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-ocaml","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-perl","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-python3","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-ruby","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-tcl","fixed_in":["2.44.0-26.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"graphviz","fixed_in":["2.42.2-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"graphviz","fixed_in":["2.42.2-8"],"sources":["osv"]},{"ecosystem":"Julia","package":"Graphviz_jll","fixed_in":["15.1.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"graphviz","fixed_in":["2.44.0-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"graphviz","fixed_in":["2.44.0-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"graphviz","fixed_in":["2.48.0-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"graphviz","fixed_in":["2.48.0-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"graphviz","fixed_in":["2.48.0-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"graphviz","fixed_in":["2.48.0-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"graphviz","fixed_in":["9.0.0-r20071","9.0.0-r20074","9.0.0-r20072","9.0.0-r20073","9.0.0-r20075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.20","package":"rootio-graphviz","fixed_in":["9.0.0-r20071","9.0.0-r20074","9.0.0-r20072","9.0.0-r20073","9.0.0-r20075"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"graphviz","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"graphviz","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"graphviz-addons","fixed_in":["2.48.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphviz","fixed_in":["2.36.0-0ubuntu3.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphviz","fixed_in":["2.38.0-12ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphviz","fixed_in":["2.40.1-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"graphviz","fixed_in":["2.42.2-6ubuntu0.1+esm1","2.42.2-6ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphviz","fixed_in":["2.42.2-3ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.4-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.4-12"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.2-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-graphs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"graphviz-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-25.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-graphs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"graphviz-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-26.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~git231018-1","10.0.0~git231105-1","10.0.0~git231111-1","10.0.0~git231209-1","10.0.0~git231210-1","10.0.0~git231218-1","10.0.1-1","11.0.0-1","12.0.0-1","12.1.0-1","12.1.1-1","12.1.2-1","12.2.0-1","12.2.1-1","13.1.1-1","13.1.2-1","14.0.1-1","14.0.2-1","14.0.4-1","14.0.5-1","14.0.5-2","14.1.1-1","14.1.1-2","14.1.2-1","16.0.0-1","16.1.0-1","2.42.2-10","2.42.2-7","2.42.2-7+deb12u1","2.42.2-8","2.42.2-9","2.42.4-1","2.42.4-2","2.42.4-3","8.1.0-1","8.1.0-2","9.0.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-8"}]}]},{"source":"osv","ecosystem":"Julia","package":"Graphviz_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"15.1.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44.0-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r20071"},{"fixed":"9.0.0-r20074"},{"fixed":"9.0.0-r20072"},{"fixed":"9.0.0-r20073"},{"fixed":"9.0.0-r20075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.20","package":"rootio-graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-r20071"},{"fixed":"9.0.0-r20074"},{"fixed":"9.0.0-r20072"},{"fixed":"9.0.0-r20073"},{"fixed":"9.0.0-r20075"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"graphviz-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.0-0ubuntu3.2+esm2"}]}],"versions":["2.26.3-15ubuntu4","2.34.0-0ubuntu4","2.34.0-0ubuntu5","2.36.0-0ubuntu1","2.36.0-0ubuntu2","2.36.0-0ubuntu3","2.36.0-0ubuntu3.1","2.36.0-0ubuntu3.2","2.36.0-0ubuntu3.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-12ubuntu2.1+esm2"}]}],"versions":["2.38.0-10build1","2.38.0-11","2.38.0-12","2.38.0-12build1","2.38.0-12ubuntu1","2.38.0-12ubuntu2","2.38.0-12ubuntu2.1","2.38.0-12ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.1-2ubuntu0.1~esm2"}]}],"versions":["2.38.0-16ubuntu2","2.38.0-18ubuntu1","2.40.1-0ubuntu5","2.40.1-0ubuntu6","2.40.1-2","2.40.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-6ubuntu0.1+esm1"}]}],"versions":["2.42.2-5","2.42.2-5build1","2.42.2-6","2.42.2-6ubuntu0.1~esm1","2.42.2-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.0-0ubuntu3.2+esm2"}]}],"versions":["2.26.3-15ubuntu4","2.34.0-0ubuntu4","2.34.0-0ubuntu5","2.36.0-0ubuntu1","2.36.0-0ubuntu2","2.36.0-0ubuntu3","2.36.0-0ubuntu3.1","2.36.0-0ubuntu3.2","2.36.0-0ubuntu3.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38.0-12ubuntu2.1+esm2"}]}],"versions":["2.38.0-10build1","2.38.0-11","2.38.0-12","2.38.0-12build1","2.38.0-12ubuntu1","2.38.0-12ubuntu2","2.38.0-12ubuntu2.1","2.38.0-12ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.1-2ubuntu0.1~esm2"}]}],"versions":["2.38.0-16ubuntu2","2.38.0-18ubuntu1","2.40.1-0ubuntu5","2.40.1-0ubuntu6","2.40.1-2","2.40.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-3ubuntu0.1~esm2"}]}],"versions":["2.40.1-7build1","2.40.1-7build2","2.42.2-3","2.42.2-3build1","2.42.2-3build2","2.42.2-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"graphviz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.42.2-6ubuntu0.1~esm1"}]}],"versions":["2.42.2-5","2.42.2-5build1","2.42.2-6"]}],"products":[{"vendor":"graphviz","product":"graphviz"}],"references":[{"url":"https://gitlab.com/graphviz/graphviz/-/issues/2441","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://seclists.org/fulldisclosure/2024/Jan/73","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/02/01/2","tags":["x_transferred","Mailing List","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Feb/24","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://seclists.org/fulldisclosure/2024/Feb/24","tags":["x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/176816/graphviz-2.43.0-Buffer-Overflow-Code-Execution.html","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/73","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/62","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46045","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xpmp-64jj-f5gg"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-46045","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1753376162.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776698705.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46045.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46045","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1209","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241351-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46045","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241351-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46045","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6708-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46045","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46045","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T00:00:00Z","modified":"2025-11-04T18:18:36.138Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:23.645864Z"}],"euvd":[{"id":"EUVD-2023-50306","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T00:00:00Z","modified":"2025-11-04T18:18:36Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-xpmp-64jj-f5gg","title":"Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE:...","description":"Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:30:31Z","modified":"2026-03-20T05:07:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:06:44.064136Z"}],"nvd":[{"id":"CVE-2023-46045","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:15:45.123Z","modified":"2026-06-17T06:29:55.777Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"AZL-34237","title":"CVE-2023-46045 affecting package graphviz for versions less than 2.42.4-10","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:15:45Z","modified":"2026-04-21T04:27:04.047743Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34768","title":"CVE-2023-46045 affecting package graphviz for versions less than 2.42.4-12","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:15:45Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"BELL-CVE-2023-46045","status":"published","published":"2024-01-30T05:58:23.101856Z","modified":"2026-01-26T09:35:34.336732Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-46045","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T00:00:00Z","modified":"2026-10-28T02:30:52.582710578Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46045","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:15:45.123Z","modified":"2026-10-26T18:02:42.402368531Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"JLSEC-2026-1276","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2026-08-13T09:38:52.525Z","modified":"2026-08-13T09:45:03.359877893Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2024-1209","title":"graphviz security update","description":"Graphviz is open source graph visualization software. Graph visualization is a way of representing structural  information as diagrams of abstract graphs and networks. It has important applications in networking, bioinformatics,  software engineering, database and web design, machine learning, and in visual interfaces for other technical domains.\r\n\r\nSecurity Fix(es):\r\n\r\nGraphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.(CVE-2023-46045)","status":"published","published":"2024-02-23T11:06:39Z","modified":"2026-08-18T01:17:11.883752962Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"UBUNTU-CVE-2023-46045","description":"Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.","status":"published","published":"2024-02-02T06:15:00Z","modified":"2026-04-22T14:14:21.954913Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2025-1753376162","title":"graphviz: Fix of CVE-2023-46045","description":"- CVE-2023-46045: fix out-of-bounds read via crafted config6a file","status":"published","published":"2025-07-24T16:56:06Z","modified":"2026-06-01T00:30:44.776162653Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1776698705","title":"graphviz: Fix of CVE-2023-46045","description":"- CVE-2023-46045: fix out-of-bounds read via crafted config6a file","status":"published","published":"2026-04-20T15:25:09Z","modified":"2026-06-01T00:32:47.177463984Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"openSUSE-SU-2024:13761-1","title":"graphviz-2.49.3-9.1 on GA media","description":"These are all security issues fixed in the graphviz-2.49.3-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:28.612309Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-OS-ALPINE-320-CVE-2023-46045","title":"CVE-2023-46045 in graphviz - Patched by Root","description":"Root has patched CVE-2023-46045 in the graphviz package for Root:Alpine:3.20. Multiple fixed versions available.","status":"published","published":"2026-09-29T09:24:34Z","modified":"2026-09-29T10:15:24.953246012Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2024:1351-1","title":"Security update for graphviz","description":"This update for graphviz fixes the following issues:\n\n- CVE-2023-46045: Fixed out-of-bounds read via a crafted config6a file (bsc#1219491)\n","status":"published","published":"2024-04-19T11:45:52Z","modified":"2026-02-04T04:23:47.505962Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1351-2","title":"Security update for graphviz","description":"This update for graphviz fixes the following issues:\n\n- CVE-2023-46045: Fixed out-of-bounds read via a crafted config6a file (bsc#1219491)\n","status":"published","published":"2024-09-03T15:03:23Z","modified":"2026-02-04T03:01:39.805629Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6708-1","title":"graphviz vulnerability","description":"It was discovered that Graphviz incorrectly handled certain config6a files.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2024-03-21T12:20:33Z","modified":"2026-06-29T13:51:07.394803644Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}