Lucene search

K
zdiOsori (Young Min Kim)ZDI-23-1526
HistoryOct 04, 2023 - 12:00 a.m.

(0Day) MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

2023-10-0400:00:00
Osori (Young Min Kim)
www.zerodayinitiative.com
5
remote code execution
musescore
cap files
heap-based buffer overflow
user interaction
malicious page
malicious file
data validation
current process.

0.001 Low

EPSS

Percentile

28.9%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

0.001 Low

EPSS

Percentile

28.9%

Related for ZDI-23-1526