CVE-2023-39453 Use after free in ImageGear
A use-after-free flaw in Accusoft ImageGear allows arbitrary code execution via a specially crafted malformed file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39453?
CVE-2023-39453 is a critical use after free vulnerability in Accusoft Imagegear, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can deliver this file to trigger this vulnerability.
Weakness: CWE-416
Which versions are affected by CVE-2023-39453?
It affects 1 product.
Products include Accusoft Imagegear.
How do I fix CVE-2023-39453?
No fix has been published for CVE-2023-39453 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-39453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-39453 exists.
Other vulnerabilities in Accusoft Imagegear
Sources
Also known as GHSA-9h69-jrqq-936c.