CVE Database›CVE-2023-40546

CVE-2023-40546

shim: Out-of-bounds read printing error messages

Loading…

Severity

Moderate

Red Hat Product Security

6.2

CVSS 3.1

Review impact separately from score.

Published · January 23, 2024

Updated · June 26, 2026

Description

A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

There's no available mitigation for this issue.

CVSS / CWE

CVSS 3.1 · 6.2
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 · NULL Pointer Dereference