CVE-2023-40163

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Accusoft	ImageGear	20.1
accusoft	imagegear	20.1

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1836Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1836Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1836

Timeline

Published: Sep 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-401645.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingS CVE-2023-401657.5rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replac CVE-2023-401665.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManager CVE-2023-401675.3Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character CVE-2023-401686.5TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a CVE-2023-40176.1The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parame CVE-2023-401706.1jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of CVE-2023-401717.5Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in CVE-2023-401728.8Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site reque CVE-2023-401737.5Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1 CVE-2023-401749.8Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient sessi CVE-2023-401759.8Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chun