CVE-2023-43641

libcue: out-of-bounds array access leads to RCE

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · October 9, 2023

Updated · November 22, 2025

Description

A flaw was found in libcue, which is consumed by the tracker-miners application. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious web page, allowing remote code execution.

Statement

The libcue library is disabled in Red Hat builds of the tracker-miners package making Red Hat Enterprise Linux 7, 8 and 9 not affected by this vulnerability.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787 · Out-of-bounds Write