CVE-2023-43252

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Oct/15Exploit, Mailing List, Third Party Advisory
https://github.com/mrtouch93/exploits/tree/main/NConvert7.136/Stack%20Buffer%20OverrunExploit, Third Party Advisory
https://www.xnview.com/en/nconvert/Product
http://packetstormsecurity.com/files/175145/XNSoft-Nconvert-7.136-Buffer-Overflow-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/Oct/15Exploit, Mailing List, Third Party Advisory
https://github.com/mrtouch93/exploits/tree/main/NConvert7.136/Stack%20Buffer%20OverrunExploit, Third Party Advisory
https://www.xnview.com/en/nconvert/Product

Timeline

Published: Oct 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-432566.5A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by expl CVE-2023-43267.5Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuite CVE-2023-432606.1Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin CVE-2023-432617.5An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components CVE-2023-432636.1A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.CVE-2023-432675.4A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web sc CVE-2023-432688.8Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability.CVE-2023-432699.8pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability.CVE-2023-43275.5Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any lo CVE-2023-432709.8dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.CVE-2023-432719.1Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder thro CVE-2023-432747.5Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.