CVE-2023-43826 Apache Guacamole: Integer overflow in handling of VNC image buffers

What is CVE-2023-43826?

CVE-2023-43826 is a high-severity vulnerability in Apache Guacamole, published on 19 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process.

Users are recommended to upgrade to version 1.5.4, which fixes this issue.

Weakness: CWE-190

Which versions are affected by CVE-2023-43826?

2 open source packages ship an affected version, including guacamole and guacamole-server. It affects 1 product.

Products include Apache Guacamole.

How do I fix CVE-2023-43826?

Upgrade guacamole to 1.5.3 or later.

Is CVE-2023-43826 being exploited?

There is no known exploitation of CVE-2023-43826 in the wild and no public exploit code.

Other vulnerabilities in Apache Guacamole

• CVE-2021-43999 Improper validation of SAML responses High 8.8
• CVE-2017-3158 Apache Guacamole Race Condition vulnerability High 8.1
• CVE-2019-19603 Null dereference in n/a High 7.5
• CVE-2018-1340 Missing Encryption of Sensitive Data in Apache Guacamole High 7.5
• CVE-2024-35164 Apache Guacamole: Improper input validation of console codes Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-guacamole-2023-43826, BIT-guacamole-server-2023-43826, GHSA-hhj4-xc5f-6f87, UBUNTU-CVE-2023-43826.