CVE-2023-33864

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/2Exploit, Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://renderdoc.org/Product
https://security.gentoo.org/glsa/202311-10
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/2Exploit, Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00008.html
https://renderdoc.org/Product
https://security.gentoo.org/glsa/202311-10
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit, Third Party Advisory

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-338657.8RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of owners CVE-2023-338668.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting CVE-2023-338677.8Improper buffer restrictions in some Intel(R) RealSense(TM) ID software for Intel(R) RealSense(TM) 450 FA in version 0.25.0 may allow an aut CVE-2023-338689.8The number of login attempts is not limited. This could allow an attacker to perform a brute force on HTTP basic authentication.CVE-2023-338699.8Enphase Envoy versions D7.0.88 is vulnerable to a command injection exploit that may allow an attacker to execute root commands.CVE-2023-33875.4The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img'CVE-2023-338707.8Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially en CVE-2023-338717.5Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a directory traversal vulnerability that could allow an unauthenticated user t CVE-2023-338725.5Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable informati CVE-2023-338737.8This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to Sys CVE-2023-338747.3Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver installation software before CVE-2023-338755.5Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauthen