CVE-2023-53156
transpose: Buffer overflow due to integer overflow
CVE-2023-53156 is a medium vulnerability (CVSS 4.5) in Ejmahler Transpose, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in transpose 0.2.3.
- Severity
- 4.5 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.34%EPSS, 28th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2.3transpose +7 more
Description
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
transposecrates.io | 0.1.0 up to 0.2.3 | 0.2.3 |
rust-transposeDebian:13 | All versions, plus listed versions 0.2.2-10.2.3-1 | None known |
rust-transposeDebian:14 | before 0.2.3-1, plus listed versions 0.2.2-1 | 0.2.3-1 |
transposecrates.io | 0.0.0-0 up to 0.2.3 | 0.2.3 |
rust-transposeUbuntu:25.10 | All versions, plus listed versions 0.2.2-1 | None known |
rust-transposeUbuntu:26.10 | All versions, plus listed versions 0.2.3-1 | None known |
rust-transposeUbuntu:26.04:LTS | All versions, plus listed versions 0.2.2-10.2.3-1 | None known |
framework-inputmodule-controlopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 0.2.0-3.1 | 0.2.0-3.1 |
What each source reports
CVE List Score used
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
CVE-2023-53156- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2023-59767
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
EUVD-2023-59767- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5gmm-6m36-r7jh
transpose: Buffer overflow due to integer overflow
Given the function transpose::transpose:
fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
The safety check input_width * input_height == output.len() can fail due to input_width * input_height overflowing in such a way that it equals output.len().
As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since * panics on overflow in debug mode.
Exploiting this issue requires the caller to pass input_width and input_height arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
- Record
GHSA-5gmm-6m36-r7jh- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-120, CWE-190
- Updated
- 2026-11-02
NVD
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
CVE-2023-53156- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
CVE-2023-53156- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-53156
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
DEBIAN-CVE-2023-53156- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5gmm-6m36-r7jh
transpose: Buffer overflow due to integer overflow
Given the function transpose::transpose:
fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
The safety check input_width * input_height == output.len() can fail due to input_width * input_height overflowing in such a way that it equals output.len().
As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since * panics on overflow in debug mode.
Exploiting this issue requires the caller to pass input_width and input_height arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
- Record
GHSA-5gmm-6m36-r7jh- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-120, CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-53156
The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
- Record
UBUNTU-CVE-2023-53156- CVSS 3.1
- 4.5 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15433-1No score
framework-inputmodule-control-0.2.0-3.1 on GA media
These are all security issues fixed in the framework-inputmodule-control-0.2.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15433-1- Updated
- 2026-11-02
OSVRUSTSEC-2023-0080No score
Buffer overflow due to integer overflow in `transpose`
Given the function transpose::transpose:
fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
The safety check input_width * input_height == output.len() can fail due to input_width * input_height overflowing in such a way that it equals output.len().
As a result of failing the safety check, memory past the end of output is written to. This only occurs in release mode since * panics on overflow in debug mode.
Exploiting this issue requires the caller to pass input_width and input_height arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.
- Record
RUSTSEC-2023-0080- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.