CVE-2023-54329 Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)
Unauthenticated attackers can execute arbitrary commands with system privileges via crafted XML packets exploiting a stack overflow in Inbit Messenger.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-54329?
CVE-2023-54329 is a critical memory corruption vulnerability in Inbit Messenger, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.
Which versions are affected by CVE-2023-54329?
It affects 1 product.
Products include Inbit Inbit Messenger.
How do I fix CVE-2023-54329?
No fix has been published for CVE-2023-54329 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-54329 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-54329 exists.
Other vulnerabilities in Inbit Messenger
Sources
Also known as GHSA-xvhq-qrmp-cx9w.