CVE-2023-39914
High
Published: 13 September 2023
Published
13 September 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.0031
54.1th percentile
Risk Priority
15
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2023-39914 is a high-severity Improper Handling of Undefined Values (CWE-232) vulnerability in Nlnetlabs Bcder. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 45.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2446
Vulnerability details
NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types…
more
that utilized delayed decoding.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
nlnetlabs
bcder
≤ 0.7.3
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.