CVE-2023-48221 wire-avs remote format string vulnerability
A remote format string vulnerability in the Wire AVS library allows attackers to cause denial of service or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-48221?
CVE-2023-48221 is a high-severity vulnerability in wireapp wire-avs, published on 20 Nov 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.
Weakness: CWE-134
Which versions are affected by CVE-2023-48221?
It affects 1 product.
Products include Wire Audio\, Video\, and Signaling.
How do I fix CVE-2023-48221?
No fix has been published for CVE-2023-48221 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48221 being exploited?
There is no known exploitation of CVE-2023-48221 in the wild and no public exploit code.
Sources
Also known as GHSA-m4xg-fcr3-w3pq.