NuGet Package Vulnerabilities

Open in search

Vulnerabilities associated with CefSharp.Common.

Packages

Clear package

Showing 8 vulnerabilities on this page for CefSharp.Common

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

### Summary `FolderSchemeHandlerFactory` was intended to restrict served files to a configured `rootFolder`, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served. ### Details In affected versions, `FolderSchemeHandlerFactory` canonicalized `rootFolder`, decoded the request path, combined it with the root, and then allowed the file when: ``…

CWE-22Jun 30, 2026
CVSS-v3.1EPSS-PoCs0SignalsSTIX

CefSharp affected by libvpx's heap buffer overflow in vp8 encoding

Google is aware that an exploit for CVE-2023-5217 exists in the wild. Description Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) References - https://www.cve.org/CVERecord?id=CVE-2023-5217 - https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Oct 5, 2023
CVSS-EPSS-PoCs0SignalsSTIX

CefSharp affected by heap buffer overflow in WebP

**Google is aware that an exploit for [CVE-2023-4863](https://www.cve.org/CVERecord?id=CVE-2023-4863) exists in the wild.** ### Description Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) ### References - https://www.cve.org/CVERecord?id=CVE-2023-4863 - https://nvd.nist.gov/vuln/detail/CVE-2023-4863 - https://www.techtarget.com/searchsecurit…

Sep 21, 2023
CVSS-EPSS-PoCs0SignalsSTIX

Use after free in Animation

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-416Apr 4, 2022
CVSS8.8v3.1EPSS20.8%PoCs0SignalsSTIX

Use after free in CefSharp

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CWE-416Jan 8, 2021
CVSS9.6v3.1EPSS2.75%PoCs0SignalsSTIX

Inappropriate implementation in V8 in CefSharp

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-119CWE-787Jan 8, 2021
CVSS8.8v3.1EPSS2.83%PoCs0SignalsSTIX

Inappropriate implementation in V8

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-787CWE-843Nov 3, 2020
CVSS8.8v3.1EPSS48.6%PoCs0SignalsSTIX

Heap buffer overflow in CefSharp

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CWE-119CWE-120CWE-787Nov 3, 2020
CVSS9.6v3.1EPSS44.3%PoCs2SignalsSTIX