CVE-2023-33864

RenderDoc 1.26 Local Privilege Escalation / Remote Code Execution

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.

RenderDoc versions 1.26 and below suffer from integer underflow, integer overflow, and symlink vulnerabilities.

*Credits: N/A

CVSS Scores

NISTv3.1 9.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-05-23 CVE Reserved
2023-06-07 CVE Published
2024-08-02 CVE Updated
2024-08-02 First Exploit
2024-09-11 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-190: Integer Overflow or Wraparound

CAPEC

References (6)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html	Mailing List
https://renderdoc.org	Product

URL	Date	SRC
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html	2024-08-02
http://seclists.org/fulldisclosure/2023/Jun/2	2024-08-02
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txt	2024-08-02

URL	Date	SRC

URL	Date	SRC
https://security.gentoo.org/glsa/202311-10	2023-11-25

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Renderdoc Search vendor "Renderdoc"		Renderdoc Search vendor "Renderdoc" for product "Renderdoc"				< 1.27 Search vendor "Renderdoc" for product "Renderdoc" and version " < 1.27"		-		Affected