CVE-2023-40216

MEDIUM

Openbsd - Missing Authorization

Title source: rule

Description

OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.

References (2)

[Patch, Vendor Advisory] https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/014_wscons.patch.sig

[Patch] https://github.com/openbsd/src/commit/9d3f688f46eba347e96ff0ae9506ef2061622e0c

View Patch ZIP pw:eip

Scores

CVSS v3 5.5

EPSS 0.0004

EPSS Percentile 11.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-862

Status published

Affected Products (14)

openbsd/openbsd

Timeline

Published Aug 10, 2023

Tracked Since Feb 18, 2026