CVE-2023-53729

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: qmi_encdec: Restrict string length in decode

The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2025
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-53739.8A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function regis CVE-2023-53730In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust CVE-2023-53731In the Linux kernel, the following vulnerability has been resolved: netlink: fix potential deadlock in netlink_set_err() syzbot reported a CVE-2023-53732In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL CVE-2023-537337.8In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When CVE-2023-537348.7dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and pot CVE-2023-537355.3WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execu CVE-2023-537365.4A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administra CVE-2023-537374.8A stored cross-site scripting vulnerability in Kentico Xperience allows global administrators to inject malicious payloads via the Localizat CVE-2023-537385.4A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts via page preview CVE-2023-537399.9Tinycontrol LAN Controller v3 LK3 version 1.58a contains an unauthenticated vulnerability that allows remote attackers to download configura CVE-2023-53749.8A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is a