{"id":"CVE-2023-46051","aliases":["DEBIAN-CVE-2023-46051","EUVD-2023-50312","GHSA-pjw3-8x26-xpwm","OESA-2024-2000","SUSE-SU-2024:1310-1","SUSE-SU-2026:3628-1"],"status":"disputed","title":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE:...","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0026,"percentile":0.1787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2024-03-27T00:00:00Z","modified":"2026-10-26T18:01:44Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.20220321.62855-5.1","2022.20220321.62855-5.1+deb12u1","2022.20220321.62855-5.1+deb12u2","2022.20220321.62855-6","2022.20220321.62855-7","2022.20220321.62855-8","2023.20230311.66589-1","2023.20230311.66589-2","2023.20230311.66589-3","2023.20230311.66589-4","2023.20230311.66589-5","2023.20230311.66589-6","2023.20230311.66589-7","2023.20230311.66589-8","2023.20230311.66589-9","2024.20240313.70630+ds-1","2024.20240313.70630+ds-2","2024.20240313.70630+ds-3","2024.20240313.70630+ds-4","2024.20240313.70630+ds-5","2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:13","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"Debian:14","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2024.20240313.70630+ds-6","2025.20250727.75242+ds-1","2025.20250727.75242+ds-2","2025.20250727.75242+ds-3","2025.20250727.75242+ds-4","2025.20250727.75242+ds-5","2025.20250727.75242+ds-5~hurd.1","2026.20260303.78225+ds-1","2026.20260303.78225+ds-2","2026.20260303.78225+ds-3","2026.20260303.78225+ds-4","2026.20260303.78225+ds-5"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"texlive-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210325-8.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150400.31.6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"texlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210325-150600.38.3.1"}]}],"bundled":3}],"references":[{"url":"https://tug.org/pipermail/tex-live/2023-August/049406.html","tags":["x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Jan/68","tags":["mailing-list","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/176822/tex-live-944e257-Null-Pointer.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46051","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pjw3-8x26-xpwm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46051","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46048","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241310-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222126","tags":["report"]},{"url":"https://bugzilla.suse.com/1222127","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46051","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263628-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272432","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63729","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-46051","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"disputed","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:45.433Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50312","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T00:00:00Z","modified":"2025-11-04T18:18:45Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:49:24.543935Z"}],"ghsa":[{"id":"GHSA-pjw3-8x26-xpwm","title":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE:...","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T06:30:32Z","modified":"2025-11-04T21:31:23Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:36.536202Z"}],"nvd":[{"id":"CVE-2023-46051","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"disputed","published":"2024-03-27T06:15:10.243Z","modified":"2026-06-17T06:29:56.767Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:09:10.192572Z"}],"osv":[{"id":"DEBIAN-CVE-2023-46051","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T06:15:10.243Z","modified":"2026-10-26T18:01:44.222689338Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2024-2000","title":"texlive-base security update","description":"The TeX Live software distribution offers a complete TeX system for a variety of Unix, Macintosh, Windows and other platforms. It encompasses programs for editing, typesetting, previewing and printing of TeX documents in many different languages, and a large collection of TeX macros and font libraries.\r\n\r\nSecurity Fix(es):\r\n\r\nTex Live 944e257 has a NULL pointer dereference in texk/web2c/pdftexdir/writet1.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46048)\r\n\r\nTeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.(CVE-2023-46051)","status":"published","published":"2024-08-16T11:07:28Z","modified":"2026-08-18T01:18:33.800078635Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"CVE-2023-46051","description":"TeX Live 944e257 allows a NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c. NOTE: this is disputed because it should be categorized as a usability problem.","status":"published","published":"2024-03-27T06:15:10Z","modified":"2026-08-18T09:41:53.31740981Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"SUSE-SU-2024:1310-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: Fixed NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126)\n- CVE-2023-46051: Fixed NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127)\n","status":"published","published":"2024-04-16T10:02:49Z","modified":"2026-02-04T03:40:56.213346Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2026:3628-1","title":"Security update for texlive","description":"This update for texlive fixes the following issues:\n\n- CVE-2023-46048: NULL pointer dereference in texk/web2c/pdftexdir/writet1.c (bsc#1222126).\n- CVE-2023-46051: NULL pointer dereference in texk/web2c/pdftexdir/tounicode.c (bsc#1222127).\n- CVE-2026-63729: use-after-free in synctex_parser.c in TeX Live (bsc#1272432).\n","status":"published","published":"2026-08-17T16:42:30Z","modified":"2026-08-18T09:30:06.064122252Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}