CVE-2023-30576: medium-severity vulnerability in Apache Guacamole
Apache Guacamole: Use-after-free in handling of RDP audio input buffer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 1.1%
Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Apache Software Foundation · Apache GuacamoleRelated CVEs — Apache Guacamole
In the same product, most dangerous first.
CVE-2018-1340—CVE-2018-1340EPSS 2.0%CVE-2021-41767—Private tunnel identifier may be included in the non-private details of active connectionsEPSS 2.0%CVE-2021-43999—Improper validation of SAML responsesEPSS 1.8%CVE-2017-3158—CVE-2017-3158EPSS 1.2%CVE-2023-30575MEDIUMApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsEPSS 1.0%CVE-2023-43826HIGHApache Guacamole: Integer overflow in handling of VNC image buffersEPSS 0.9%