CVE catalog

CVE-2023-43641

libcue: CVE-2023-43641

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
17.18% · Oct 25, 2026

libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcuesid2.2.1-4.2fixed
Debianlibcueforky2.2.1-4.2fixed
Debianlibcuetrixie2.2.1-4.1fixed
Debianlibcuebookworm2.2.1-4+deb12u1fixed
Debianlibcuebookworm-security2.2.1-4+deb12u1fixed
Ubuntulibcue20.042.2.1-2vulnerable
Ubuntulibcue20.042.2.1-2ubuntu0.1fixed
Ubuntulibcue22.042.2.1-3build2vulnerable
Ubuntulibcue22.042.2.1-3build3vulnerable
Ubuntulibcue22.042.2.1-3ubuntu0.1fixed
Ubuntulibcue16.041.4.0-1vulnerable
Ubuntulibcue18.041.4.0-1vulnerable
Ubuntulibcue20.042.2.1-2vulnerable
Ubuntulibcue20.042.2.1-2ubuntu0.1fixed
Ubuntulibcue22.042.2.1-3build2vulnerable
Ubuntulibcue22.042.2.1-3build3vulnerable
Ubuntulibcue22.042.2.1-3ubuntu0.1fixed
Ubuntulibcue24.042.2.1-4vulnerable
Ubuntulibcue24.042.2.1-4ubuntu1fixed
Suselibcuelinux enterprise module for desktop applications 15 sp42.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise module for desktop applications 15 sp52.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise high performance computing 15 sp2-ltss2.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise high performance computing 15 sp3-espos2.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise high performance computing 15 sp3-ltss2.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise server 15 sp2-ltss2.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise server 15 sp3-ltss2.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise server for sap applications 15 sp22.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise server for sap applications 15 sp32.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise workstation extension 15 sp42.1.0-150000.3.3.1fixed
Suselibcuelinux enterprise workstation extension 15 sp52.1.0-150000.3.3.1fixed
Suselibcueenterprise storage 7.12.1.0-150000.3.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcuesourcesid2.2.1-4.1not yet assignedNot reportedNot reported
Debianlibcuesourceforky2.2.1-4.1not yet assignedNot reportedNot reported
Debianlibcuesourcetrixie2.2.1-4.1not yet assignedNot reportedNot reported
Debianlibcuesourcebookworm2.2.1-4+deb12u1not yet assignedNot reportedNot reported
Ubuntulibcuedeb20.042.2.1-2ubuntu0.1Not reportedUSN-6423-1Not reported
Ubuntulibcuedeb22.042.2.1-3ubuntu0.1Not reportedUSN-6423-1Not reported
Ubuntulibcuedeb20.042.2.1-2ubuntu0.1Not reportedUBUNTU-CVE-2023-43641Not reported
Ubuntulibcuedeb22.042.2.1-3ubuntu0.1Not reportedUBUNTU-CVE-2023-43641Not reported
Ubuntulibcuedeb24.042.2.1-4ubuntu1Not reportedUBUNTU-CVE-2023-43641Not reported
Suselibcuerpmlinux enterprise module for desktop applications 15 sp42.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise module for desktop applications 15 sp52.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise high performance computing 15 sp2-ltss2.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise high performance computing 15 sp3-espos2.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise high performance computing 15 sp3-ltss2.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise server 15 sp2-ltss2.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise server 15 sp3-ltss2.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise server for sap applications 15 sp22.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise server for sap applications 15 sp32.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise workstation extension 15 sp42.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmlinux enterprise workstation extension 15 sp52.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported
Suselibcuerpmenterprise storage 7.12.1.0-150000.3.3.1Not reportedSUSE-SU-2023:4090-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]