CyberSecBulletin
CVE-2026-43233NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-43233 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041, 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a, 81f2fc5b0d0cf4696146f00f837596d10b92dead as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.46% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041 or 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a or 81f2fc5b0d0cf4696146f00f837596d10b92dead or 7ef82863d42261817a6394c6c881bd6757a70f16, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, 81f2fc5b0d0cf4696146f00f837596d10b92dead; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, 7ef82863d42261817a6394c6c881bd6757a70f16; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, 53d32735d77ab56cc3fc7bd53a7d099418f19be1; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, f0a83d0a4b7c127d32ac06d607a9214937716129; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224; ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa up to, but not including, baed0d9ba91d4f390da12d5039128ee897253d60; and 1 more rangesbcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041, 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a, 81f2fc5b0d0cf4696146f00f837596d10b92dead, 7ef82863d42261817a6394c6c881bd6757a70f16, 53d32735d77ab56cc3fc7bd53a7d099418f19be1, f0a83d0a4b7c127d32ac06d607a9214937716129
LinuxLinux Kernel4.15.1 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6; 4.15; and 1 more ranges5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
LowSome restricted data can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ... if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end), which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323 helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a 1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at every other get_len() call site in the same file, where the caller checks for 2 bytes of available data before calling get_len().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.