CVE-2023-0667

Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

2.01% chance of exploitation in the next 30 days, 79th percentile

Published

2023-06-07

Updated

2025-11-03

Proof-of-concept exploits (2)

• https://gitlab.com/wireshark/wireshark/-/issues/19086
• https://takeonme.org/cves/CVE-2023-0667.html

References

• CVE Record
• NVD entry

Related

• CVE-2023-0666
• CVE-2023-0668
• CVE-2023-0663
• CVE-2023-0669
• CVE-2023-0660
• CVE-2023-0671