CVE-2023-48349 - Vulnerability Details - OpenCVE

In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Google	Android
Unisoc	S8000 Sc7731e Sc9832e Sc9863a T310 T606 T610 T612 T616 T618 T760 T770 T820

Configuration 1 [-]

AND

OR	cpe:2.3:o:google:android:11.0:::::::*
	cpe:2.3:o:google:android:12.0:::::::*

OR	cpe:2.3:h:unisoc:s8000:-:::::::*
	cpe:2.3:h:unisoc:sc7731e:-:::::::*
	cpe:2.3:h:unisoc:sc9832e:-:::::::*
	cpe:2.3:h:unisoc:sc9863a:-:::::::*
	cpe:2.3:h:unisoc:t310:-:::::::*
	cpe:2.3:h:unisoc:t606:-:::::::*
	cpe:2.3:h:unisoc:t610:-:::::::*
	cpe:2.3:h:unisoc:t612:-:::::::*
	cpe:2.3:h:unisoc:t616:-:::::::*
	cpe:2.3:h:unisoc:t618:-:::::::*
	cpe:2.3:h:unisoc:t760:-:::::::*
	cpe:2.3:h:unisoc:t770:-:::::::*
	cpe:2.3:h:unisoc:t820:-:::::::*

No data.

References

Link	Providers
https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545

History

Fri, 20 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Unisoc

Published: 2024-01-18T02:44:51.800Z

Updated: 2025-06-20T18:04:14.721Z

Reserved: 2023-11-15T08:11:00.391Z

Link: CVE-2023-48349

Vulnrichment

Updated: 2024-08-02T21:30:34.435Z

NVD

Status : Modified

Published: 2024-01-18T03:15:57.693

Modified: 2025-06-20T18:15:22.090

Link: CVE-2023-48349

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-48349", "assignerOrgId": "63f92e9c-2193-4c24-98a9-93640392c3d3", "state": "PUBLISHED", "assignerShortName": "Unisoc", "dateReserved": "2023-11-15T08:11:00.391Z", "datePublished": "2024-01-18T02:44:51.800Z", "dateUpdated": "2025-06-20T18:04:14.721Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "63f92e9c-2193-4c24-98a9-93640392c3d3", "shortName": "Unisoc", "dateUpdated": "2024-01-18T02:44:51.800Z"}, "references": [{"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545"}], "affected": [{"defaultStatus": "unaffected", "product": "SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000", "versions": [{"version": "Android11/Android12", "status": "affected"}], "vendor": "Unisoc (Shanghai) Technologies Co., Ltd."}], "descriptions": [{"lang": "en", "value": "In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:30:34.435Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-01-18T14:14:12.403192Z", "id": "CVE-2023-48349", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-20T18:04:14.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:30:34.435Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-48349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-18T14:14:12.403192Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-20T18:03:55.385Z"}}], "cna": {"affected": [{"vendor": "Unisoc (Shanghai) Technologies Co., Ltd.", "product": "SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000", "versions": [{"status": "affected", "version": "Android11/Android12"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545"}], "descriptions": [{"lang": "en", "value": "In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed"}], "providerMetadata": {"orgId": "63f92e9c-2193-4c24-98a9-93640392c3d3", "shortName": "Unisoc", "dateUpdated": "2024-01-18T02:44:51.800Z"}}}, "cveMetadata": {"cveId": "CVE-2023-48349", "state": "PUBLISHED", "dateUpdated": "2025-06-20T18:04:14.721Z", "dateReserved": "2023-11-15T08:11:00.391Z", "assignerOrgId": "63f92e9c-2193-4c24-98a9-93640392c3d3", "datePublished": "2024-01-18T02:44:51.800Z", "assignerShortName": "Unisoc"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "109DD7FD-3A48-4C3D-8E1A-4433B98E1E64", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "F8FB8EE9-FC56-4D5E-AE55-A5967634740C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:unisoc:s8000:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDE05D06-C798-4217-8858-8C5DC2C94751", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:sc7731e:-:*:*:*:*:*:*:*", "matchCriteriaId": "AC867249-B767-4802-868D-6D0E356C8294", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:sc9832e:-:*:*:*:*:*:*:*", "matchCriteriaId": "25BBD3C5-E87C-4730-970C-19DF855AC3A2", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:sc9863a:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE00DFDE-97DD-4D33-B580-73FEF677C71B", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t310:-:*:*:*:*:*:*:*", "matchCriteriaId": "F20E00D8-2F00-4FA3-9455-37DC89908D96", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t606:-:*:*:*:*:*:*:*", "matchCriteriaId": "905E39DD-7948-40A4-B042-EBB9A9591347", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t610:-:*:*:*:*:*:*:*", "matchCriteriaId": "CDC980D6-B797-4AE1-B553-35395AE80D07", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t612:-:*:*:*:*:*:*:*", "matchCriteriaId": "98408A48-561A-49D1-967F-834311742B7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t616:-:*:*:*:*:*:*:*", "matchCriteriaId": "756E5850-CDC7-46C2-BAFC-1E2A359A2709", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t618:-:*:*:*:*:*:*:*", "matchCriteriaId": "39002ECE-636A-4FEB-9A0B-8127E8AAC844", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t760:-:*:*:*:*:*:*:*", "matchCriteriaId": "3D965CCA-C963-49E4-ACF0-2A9F458AF470", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t770:-:*:*:*:*:*:*:*", "matchCriteriaId": "0FFEF06A-E3E0-486F-89CC-D52FF3F26F0B", "vulnerable": false}, {"criteria": "cpe:2.3:h:unisoc:t820:-:*:*:*:*:*:*:*", "matchCriteriaId": "49601008-D3FF-47CC-B961-6FDDFC7A0596", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed"}, {"lang": "es", "value": "En video decoder, existe una posible escritura fuera de los l\u00edmites debido a una comprobaci\u00f3n de l\u00edmites faltantes. Esto podr\u00eda provocar una denegaci\u00f3n de servicio local sin necesidad de privilegios de ejecuci\u00f3n adicionales."}], "id": "CVE-2023-48349", "lastModified": "2025-06-20T18:15:22.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-01-18T03:15:57.693", "references": [{"source": "security@unisoc.com", "tags": ["Vendor Advisory"], "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1745735200442220545"}], "sourceIdentifier": "security@unisoc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}