What’s Vulnerable › Vulnerabilities

CVE-2023-46045

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-02 · updated 2026-06-17
• Weakness: CWE-125

Description

Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root.

Affected products

• Graphviz: from 2.36.0 before 10.0.0 — fixed in 10.0.0

How to fix

Upgrade to a fixed version: Graphviz 10.0.0. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/Feb/24
• https://gitlab.com/graphviz/graphviz/-/issues/2441
• https://seclists.org/fulldisclosure/2024/Feb/24
• https://seclists.org/fulldisclosure/2024/Jan/73
• https://www.openwall.com/lists/oss-security/2024/02/01/2
• http://packetstormsecurity.com/files/176816/graphviz-2.43.0-Buffer-Overflow-Code-Execution.html
• http://seclists.org/fulldisclosure/2024/Feb/24
• http://seclists.org/fulldisclosure/2024/Jan/62
• http://seclists.org/fulldisclosure/2024/Jan/73
• https://gitlab.com/graphviz/graphviz/-/issues/2441
• https://seclists.org/fulldisclosure/2024/Feb/24
• https://seclists.org/fulldisclosure/2024/Jan/73

Get alerted when CVE-2023-46045 or the next vulnerability affects your stack