CVE-2023-39743

low-risk

Published 2023-08-17

lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Lzma Software Development Kit

Pete4Abw

Technical Description https://github.com/huanglei3/lrzip-next-poc/tree/main

Exploit https://github.com/pete4abw/lrzip-next/issues/132

Technical Description https://github.com/huanglei3/lrzip-next-poc/tree/main

Exploit https://github.com/pete4abw/lrzip-next/issues/132

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal