Cyber Resilience

CVE-2023-42447

Whisperfish Blurhash-Rs 0.1.1

Published
19 September 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0052 41th percentile
Risk Priority 63 floored blend · peak EPSS

Summary

CVE-2023-42447 is a high-severity Uncaught Exception (CWE-248) vulnerability in Whisperfish Blurhash-Rs. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple…

more

panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-42444Same vendor: Whisperfish
CVE-2026-2229Shared CWE-1284, CWE-248
CVE-2026-1528Shared CWE-1284, CWE-248
CVE-2025-11594Shared CWE-1284
CVE-2026-34986Shared CWE-248
CVE-2023-5038Shared CWE-248
CVE-2026-10822Shared CWE-1284
CVE-2024-8508Shared CWE-1284
CVE-2026-42268Shared CWE-248
CVE-2025-32399Shared CWE-1284

Affected Assets

whisperfish
blurhash-rs
0.1.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V6.7.2
  • V1.4.2
  • V2.1.1
  • V2.2.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-392

Mandates alerting on audit failures, directly providing the missing report of the error condition.

addresses: CWE-392

Reporting the security and privacy status to organizational officials ensures monitoring and assessment results are communicated rather than omitted.

addresses: CWE-392

Requires reporting and escalation of error conditions and incidents per documented procedures.

addresses: CWE-392

IR testing would expose missing error reporting that prevents timely incident detection and response.

addresses: CWE-392

Offers direct support for reporting incidents, addressing the failure to report error conditions or security events.

addresses: CWE-392

Includes explicit reporting of security status and analysis results, addressing missing reports of error or monitoring conditions.

addresses: CWE-248

Prevents abrupt termination from uncaught exceptions by requiring a defined, preserved-state failure mode.

addresses: CWE-248

Requires pre-defined safe responses for uncaught exceptions so they do not result in undefined or insecure program termination.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-04 mostly match
prevents

Requiring log generation directly forces error conditions to be reported so they become visible to monitoring.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.

DE.CM-09 partial match
prevents

Runtime monitoring can surface unreported errors only if the underlying code already emits them.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect uncaught exceptions before production deployment.

A.8.15 Logging partial match
degrades

Logging of errors and exceptions helps ensure that error conditions are captured and reported.

degrades

Monitoring activities can detect missing error reporting by observing abnormal system behavior.

prevents

Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.

prevents

Application security requirements typically mandate robust error and exception handling.

prevents

Secure architecture principles call for centralized, comprehensive exception management.

References