What’s Vulnerable › Vulnerabilities

CVE-2023-48298: Integer underflow leading to stack overflow in FPC codec decompression

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-21 · updated 2026-06-17
• Weakness: CWE-191

Description

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

Affected products

• ClickHouse: from 23.3 through 23.3.17.13; from 23.8 through 23.8.7.24; from 23.9 through 23.9.5.29; from 23.10 through 23.10.4.25
• Clickhouse Cloud: from 23.9 through 23.9.2.47475

References

• https://github.com/ClickHouse/ClickHouse/pull/56795
• https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938
• https://github.com/ClickHouse/ClickHouse/pull/56795
• https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938

Get alerted when CVE-2023-48298 or the next vulnerability affects your stack