CVE-2023-28905

CVE-2023-28905 describes a heap buffer overflow in the image-processing binary of the Volkswagen MIB3 infotainment unit (notably the Skoda Superb III context) that allows arbitrary code execution. Affected component: MIB3 infotainment unit image processing binary; root cause: heap-based overflow....

CVE-2023-28909 Integer Overflow Leading to MTU Bypass

A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU...

CVE-2023-28909

CVE-2023-28909 describes a vulnerability in the Bluetooth stack of the Volkswagen MIB3 infotainment unit. The flaw arises from insufficient validation of user-supplied data, causing an integer overflow when receiving fragmented HCI packets on a channel. An attacker can bypass the MTU check on a f...

CVE-2023-28909 Integer Overflow Leading to MTU Bypass

A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU...

CVE-2023-28912 Cleartext Phonebook Information

The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3...

CVE-2023-28912 Cleartext Phonebook Information

The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3...

CVE-2023-28912

The CVE-2023-28912 issue affects the VW/Skoda MIB3 infotainment unit (notably in Skoda Superb III with OEM part 3V0035820). The root cause is storing the synchronized phone contact book in clear text, enabling an attacker with system code execution privileges or physical access to exfiltrate vehi...

CVE-2023-29113

CVE-2023-29113 impacts the MIB3 infotainment unit used in Skoda/Volkswagen vehicles. The root cause is lack of privilege separation in the unit’s proprietary inter-process communication, enabling a local attacker with system presence to undermine OS-level access controls. The issue was first iden...

CVE-2023-29113 A lack of access control in custom IPC mechanism

The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating...

PT-2025-27307 · Mib3 · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 Infotainment Unit affected versions not specified Description: An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the...

PT-2025-27316 · Mib3 · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 unit affected versions not specified Description: The issue concerns the storage of the synchronized phone contact book in clear-text by the MIB3 unit. This allows an attacker with either code execution privilege on the system or physica...

PT-2025-27317 · Volkswagen · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit affected versions not specified Description: The MIB3 infotainment unit used in Skoda and Volkswagen vehicles lacks privilege separation for its proprietary inter-process communication mechanism. This allows attackers...

PT-2025-27306 · Volkswagen · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit affected versions not specified Description: An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the...

PT-2025-27309 · Volkswagen · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 infotainment unit affected versions not specified Description: A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The issue was originally discovered in...

PT-2025-27313 · Volkswagen · Mib3

Name of the Vulnerable Software and Affected Versions: MIB3 unit affected versions not specified Description: A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow whe...

UBUNTU-CVE-2024-36347

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged...

CVE-2025-46707

Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU...

CVE-2024-11584

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...

AZL-64371 CVE-2024-11584 affecting package cloud-init for versions less than 23.3-7

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...

CVE-2024-11584

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...