CVE-2023-22419

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. When processing a comment block in stage information, the end of data cannot be verified and out-of-bounds read occurs. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
JTEKT ELECTRONICS CORPORATION	Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)	Version 1.6.9.0 and earlier

References

https://jvn.jp/en/vu/JVNVU94966432/Third Party Advisory
https://www.electronics.jtekt.co.jp/en/topics/202303035258/Vendor Advisory
https://www.electronics.jtekt.co.jp/jp/topics/2023030313639/Vendor Advisory
https://jvn.jp/en/vu/JVNVU94966432/Third Party Advisory
https://www.electronics.jtekt.co.jp/en/topics/202303035258/Vendor Advisory
https://www.electronics.jtekt.co.jp/jp/topics/2023030313639/Vendor Advisory

Timeline

Published: Mar 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22428.8A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerabi CVE-2023-224217.8Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and CVE-2023-224227.5On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforc CVE-2023-224247.8Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earl CVE-2023-224255.4Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attac CVE-2023-224274.8Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker wit CVE-2023-224286.5Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Comman CVE-2023-224297.8Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which m CVE-2023-22438.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unkno CVE-2023-224326.1Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary CVE-2023-224357.5Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.CVE-2023-224367.8The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which