CVE-2023-40546
shim: Out-of-bounds read printing error messages
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 23, 2024
Updated · June 26, 2026
Description
A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create the new variable, it tries to print an error message to the user; however, the number of parameters used by the logging function doesn't match the format string used by it, leading to a crash under certain circumstances.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
There's no available mitigation for this issue.
CVSS / CWE
CVSS 3.1 · 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference