CVE-2023-35681

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-356827.8In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. ThCVE-2023-356835.5In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection. This could leaCVE-2023-356848.8In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow. This could lead to paired device escalCVE-2023-356857.8In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to localCVE-2023-356867.8In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to localCVE-2023-356877.8In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free. This could lead to local escalation of CVE-2023-356897.8In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure deCVE-2023-35694.9In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an autheCVE-2023-356909.8In RGXDestroyHWRTData of rgxta3d.c, there is a possible arbitrary code execution due to an uncaught exception. This could lead to local escaCVE-2023-356917.2there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privCVE-2023-356927.8In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input valiCVE-2023-356936.7In incfs_kill_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of pr
CVE-2023-35681: Critical severity, CVSS 9.8 | Vulnix