Vulnerability · Published Aug 28, 2023 · Assigned by mitre
CVE-2023-40857
High 8.8
In plain English
A high-severity security flaw in the yara package (Ubuntu). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.1%top 35.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function in the exe.c component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | yara | no fix listed | UBUNTU-CVE-2023-40857 |
| Ubuntu:24.04:LTS | yara | no fix listed | UBUNTU-CVE-2023-40857 |
| Ubuntu:25.10 | yara | no fix listed | UBUNTU-CVE-2023-40857 |