CVE-2023-35126

2023-10-1917:15:10

CWE-787

CWE-129

[email protected]

web.nvd.nist.gov

cve-2023-35126

ichitaro

out-of-bounds write

arbitrary code execution

memory corruption

document processing

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.6%

JSON

An out-of-bounds write vulnerability exists within the parsers for both the “DocumentViewStyles” and “DocumentEditStyles” streams of Ichitaro 2023 1.0.1.59372 when processing types 0x0000-0x0009 of a style record with the type 0x2008. A specially crafted document can cause memory corruption, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected configurations

Vulners

NVD

Node

ichitaro_2023ichitaro_2023Range≤1.0.1.59372

CPENameOperatorVersion
justsystems:easy_postcard_maxjustsystems easy postcard maxeq-
justsystems:ichitaro_2021justsystems ichitaro 2021eq-
justsystems:ichitaro_2022justsystems ichitaro 2022eq-
justsystems:ichitaro_2023justsystems ichitaro 2023eq1.0.1.59372
justsystems:ichitaro_government_10justsystems ichitaro government 10eq-
justsystems:ichitaro_government_8justsystems ichitaro government 8eq-
justsystems:ichitaro_government_9justsystems ichitaro government 9eq-
justsystems:ichitaro_pro_3justsystems ichitaro pro 3eq-
justsystems:ichitaro_pro_4justsystems ichitaro pro 4eq-
justsystems:ichitaro_pro_5justsystems ichitaro pro 5eq-

CPE	Name	Operator	Version
justsystems:easy_postcard_max	justsystems easy postcard max	eq	-
justsystems:ichitaro_2021	justsystems ichitaro 2021	eq	-
justsystems:ichitaro_2022	justsystems ichitaro 2022	eq	-
justsystems:ichitaro_2023	justsystems ichitaro 2023	eq	1.0.1.59372
justsystems:ichitaro_government_10	justsystems ichitaro government 10	eq	-
justsystems:ichitaro_government_8	justsystems ichitaro government 8	eq	-
justsystems:ichitaro_government_9	justsystems ichitaro government 9	eq	-
justsystems:ichitaro_pro_3	justsystems ichitaro pro 3	eq	-
justsystems:ichitaro_pro_4	justsystems ichitaro pro 4	eq	-
justsystems:ichitaro_pro_5	justsystems ichitaro pro 5	eq	-

Rows per page:

1-10 of 191

CNA Affected

[
  {
    "vendor": "Ichitaro 2023",
    "product": "Ichitaro 2023",
    "versions": [
      {
        "version": "1.0.1.59372",
        "status": "affected"
      }
    ]
  }
]