{"id":"CVE-2023-49991","aliases":["AZL-34675","DEBIAN-CVE-2023-49991","DLA-4198-1","EUVD-2023-53886","GHSA-vc5p-mv7h-v2mx","MGASA-2024-0249","OESA-2024-1021","OESA-2024-1057","SUSE-SU-2024:2632-1","UBUNTU-CVE-2023-49991","USN-6858-1"],"status":"published","title":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function...","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00372,"percentile":0.31425,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-12-12T00:00:00Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Azure Linux:3","package":"espeak-ng","fixed_in":["1.52.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"espeak-ng","fixed_in":["1.51+dfsg-10+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"espeak-ng","fixed_in":["1.51+dfsg-12"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"espeak-ng","fixed_in":["1.51+dfsg-12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"espeak-ng","fixed_in":["1.49.2+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"espeak-ng","fixed_in":["1.50+dfsg-6ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"espeak-ng","fixed_in":["1.50+dfsg-10ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51+dfsg-10+deb12u1"}]}],"versions":["1.51+dfsg-10"]},{"source":"osv","ecosystem":"Debian:13","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51+dfsg-12"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51+dfsg-12"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50+dfsg-7+deb11u2"}]}],"versions":["1.50+dfsg-7","1.50+dfsg-7+deb11u1","1.50+dfsg-7+deb11u1~bpo10+1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.1-1.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe2203sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe2203sp2"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51-2.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50-150300.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50-150300.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50-150300.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50-150300.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["1.49.1+dfsg-2","1.49.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50+dfsg-6ubuntu0.1"}]}],"versions":["1.49.2+dfsg-8","1.50+dfsg-4","1.50+dfsg-5","1.50+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50+dfsg-10ubuntu0.1"}]}],"versions":["1.50+dfsg-7build2","1.50+dfsg-8","1.50+dfsg-9","1.50+dfsg-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.49.2+dfsg-1ubuntu0.1~esm1"}]}],"versions":["1.49.1+dfsg-2","1.49.2+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50+dfsg-6ubuntu0.1"}]}],"versions":["1.49.2+dfsg-8","1.50+dfsg-4","1.50+dfsg-5","1.50+dfsg-6"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"espeak-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.50+dfsg-10ubuntu0.1"}]}],"versions":["1.50+dfsg-7build2","1.50+dfsg-8","1.50+dfsg-9","1.50+dfsg-10"],"bundled":5}],"products":[{"vendor":"espeak-ng","product":"espeak-ng"}],"references":[{"url":"https://github.com/espeak-ng/espeak-ng/issues/1825","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49991","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ"},{"url":"https://github.com/advisories/GHSA-vc5p-mv7h-v2mx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49991.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49991","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0249.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33348","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6858-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49992","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49993","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49994","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1057","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242632-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218006","tags":["report"]},{"url":"https://bugzilla.suse.com/1218007","tags":["report"]},{"url":"https://bugzilla.suse.com/1218008","tags":["report"]},{"url":"https://bugzilla.suse.com/1218009","tags":["report"]},{"url":"https://bugzilla.suse.com/1218010","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49994","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-49991","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49991","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49992","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49993","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49994","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-49991","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2025-11-04T18:20:21.377Z","updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53886","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2025-11-04T18:20:21Z","updated_at":"2026-11-02T19:49:24.151242Z"}],"ghsa":[{"id":"GHSA-vc5p-mv7h-v2mx","title":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function...","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T15:30:58Z","modified":"2025-11-04T21:31:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:04:38.133233Z"}],"nvd":[{"id":"CVE-2023-49991","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T14:15:07.6Z","modified":"2026-06-17T06:36:52.217Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:54.010507Z"}],"osv":[{"id":"AZL-34675","title":"CVE-2023-49991 affecting package espeak-ng for versions less than 1.52.0-1","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T14:15:07Z","modified":"2026-04-21T04:34:01.3914Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"DEBIAN-CVE-2023-49991","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T14:15:07.6Z","modified":"2026-10-26T18:02:35.332608777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"OESA-2024-1021","title":"espeak-ng security update","description":"The eSpeak NG is a compact open source software text-to-speech synthesizer for Linux, Windows, Android and other operating systems. It supports 70 languages and accents. It is based on the eSpeak engine created by Jonathan Duddington.\r\n\r\nSecurity Fix(es):\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.(CVE-2023-49990)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.(CVE-2023-49991)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.(CVE-2023-49992)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.(CVE-2023-49993)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.(CVE-2023-49994)","status":"published","published":"2024-01-05T11:06:28Z","modified":"2026-08-18T01:18:12.256503965Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1057","title":"espeak-ng security update","description":"The eSpeak NG is a compact open source software text-to-speech synthesizer for Linux, Windows, Android and other operating systems. It supports 70 languages and accents. It is based on the eSpeak engine created by Jonathan Duddington.\r\n\r\nSecurity Fix(es):\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.(CVE-2023-49990)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.(CVE-2023-49991)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.(CVE-2023-49992)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.(CVE-2023-49993)\r\n\r\nEspeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.(CVE-2023-49994)","status":"published","published":"2024-01-12T11:06:30Z","modified":"2026-08-18T01:18:13.219417086Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"UBUNTU-CVE-2023-49991","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T14:15:00Z","modified":"2026-04-22T14:15:12.362636Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-49991","description":"Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2026-10-28T02:30:57.287494973Z","updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DLA-4198-1","title":"espeak-ng - security update","status":"published","published":"2025-05-31T00:00:00Z","modified":"2026-03-09T01:20:31.653794Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0249","title":"Updated espeak-ng packages fix security vulnerabilities","description":"It was discovered that eSpeak NG did not properly manage memory under\ncertain circumstances. An attacker could possibly use this issue to cause a\ndenial of service, or execute arbitrary code.\n","status":"published","published":"2024-07-02T16:23:27Z","modified":"2026-04-16T04:41:14.962204899Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:2632-1","title":"Security update for espeak-ng","description":"This update for espeak-ng fixes the following issues:\n\n- CVE-2023-49990: Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c (bsc#1218010)\n- CVE-2023-49991: Fixed stack-buffer-underflow exists in the function CountVowelPosition in synthdata.c (bsc#1218006)\n- CVE-2023-49992: Fixed stack-buffer-overflow exists in the function RemoveEnding in dictionary.c (bsc#1218007)\n- CVE-2023-49993: Fixed buffer overflow in ReadClause function at readclause.c (bsc#1218008)\n- CVE-2023-49994: Fixed floating point exception in PeaksToHarmspect at wavegen.c (bsc#1218009)\n","status":"published","published":"2024-07-30T07:13:18Z","modified":"2026-02-04T04:18:18.854509Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"USN-6858-1","title":"espeak-ng vulnerabilities","description":"It was discovered that eSpeak NG did not properly manage memory under certain\ncircumstances. An attacker could possibly use this issue to cause a denial\nof service, or execute arbitrary code. (CVE-2023-49990, CVE-2023-49991,\nCVE-2023-49992, CVE-2023-49993, CVE-2023-49994)\n","status":"published","published":"2024-07-01T04:21:23Z","modified":"2026-04-22T10:50:03.627283Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}