CVE-2023-32763 Memory corruption in n/a
A buffer overflow in Qt's SVG rendering allows attackers to execute arbitrary code or cause denial of service via malicious SVG files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32763?
CVE-2023-32763 is a high-severity memory corruption vulnerability in Qt Qt, published on 28 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered.
Weakness: CWE-120
Which versions are affected by CVE-2023-32763?
It affects 1 product.
Linux distribution packages (19)
libqt5-qtbase SUSE:Enterprise Storage 7 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Enterprise Storage 7.1 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 5.15.8+kde185-150500.4.3.1 |
libqt5-qtbase SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 5.15.8+kde185-150500.4.3.1 |
qt6-base SUSE:Linux Enterprise Module for Desktop Applications 15 SP5 | All versions | 6.4.2-150500.3.3.1 |
qt6-base SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 6.4.2-150500.3.3.1 |
libqt5-qtbase SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Manager Proxy 4.2 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase SUSE:Manager Server 4.2 | All versions | 5.12.7-150200.4.20.1 |
libqt5-qtbase openSUSE:Leap 15.5 | All versions | 5.15.8+kde185-150500.4.3.1 |
qt6-base openSUSE:Leap 15.5 | All versions | 6.4.2-150500.3.3.1 |
qt6-base-docs openSUSE:Leap 15.5 | All versions | 6.4.2-150500.3.3.1 |
Products include Qt Qt.
How do I fix CVE-2023-32763?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-32763 being exploited?
There is no known exploitation of CVE-2023-32763 in the wild and no public exploit code.
Other vulnerabilities in Qt Qt
Sources
Also known as AZL-26877, CLEANSTART-2026-ES27254, DEBIAN-CVE-2023-32763, GHSA-j2m5-w7qp-hqg7, SUSE-SU-2023:2780-1, SUSE-SU-2023:2824-1 and 2 more.