CVE-2023-34432

HIGH

A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.

Affects 4 products across 3 vendors.

CVSS 3.17.8
EPSS0.4%
Percentile31th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-122: Heap-Based Buffer Overflow

Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.

CWE-787: Out-of-Bounds Write

Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.

Related Attack Patterns (CAPEC)
CAPEC-92 Forced Integer Overflow
via CWE-122

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A heap buffer overflow vulnerability exists in the sox application within the lsx_readbuf function, which could lead to denial of service, code execution, or information disclosure.

BSID: BS-2023-GLOBAL-057556-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-34432?
A heap buffer overflow vulnerability exists in the sox application within the lsx_readbuf function, which could lead to denial of service, code execution, or information disclosure.
What is the CVSS score for CVE-2023-34432?
CVE-2023-34432 has CVSS 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.4%.
Is CVE-2023-34432 actively exploited?
No confirmed active exploitation of CVE-2023-34432 as of 2026-05-30.
How do I remediate CVE-2023-34432?
Priority: IMMEDIATE. Advisory: https://access.redhat.com/security/cve/CVE-2023-34432
What systems are affected by CVE-2023-34432?
CVE-2023-34432 affects Fedoraproject Fedora, Extra Packages For Enterprise Linux; Redhat Enterprise Linux; Sound Exchange Project Sound Exchange.
Vulnerability Details
CVE IDCVE-2023-34432
BSIDBS-2023-GLOBAL-057556-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2023-07-10
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Heap-Based Buffer OverflowOut-of-Bounds Write
SourceNVD
Official Description

A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could exploit this vulnerability by providing a specially crafted audio file to the sox application, potentially leading to arbitrary code execution with the privileges of the user running sox.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Fedoraproject Fedora 38
Fedoraproject Extra Packages For Enterprise Linux 8.0
Redhat Enterprise Linux 6.0 7.0
Sound Exchange Project Sound Exchange ≤ 14.4.3
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1193 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash8f13694875a75d06e2d930d6b4b728fa82d6ccdb7e89fb1572357ffccae02ef385dddba7a963fcc95ff261a6d3bccc40c5a1e0f49e40eb5070dca60635506034
Related CVEs affecting Fedoraproject
CVE-2015-0278 10.0 libuv before 0.10.34 does not properly drop group privileges, which allows co... CVE-2010-4744 10.0 Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown im... CVE-2014-1528 10.0 The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozi... CVE-2009-0846 10.0 The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the A... CVE-2009-1896 10.0 The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10...
View all Fedoraproject CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →