Skip to content
← Browse CVEs

CVE-2023-45853

Critical · CVSS 9.8EPSS 2.9%CWE-190 · Integer Overflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

References

NVD MITRE CVE.org

Published

Community ground truth

Community verdict

4 verdicts
Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: Medium (Medium 1) — CVSS base score 9.8

Practitioners rate this lower than its CVSS — likely over-rated by the score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

  • 0
    Field note · Nadia PetrovaCurated

    Scanners flag this critical on anything that links zlib — but the bug is in MiniZip, a contrib utility that is not part of the zlib library distros actually ship. zlib's maintainer noted MiniZip isn't a supported component, and Debian marked the core library unaffected. It's reachable only if your software bundles MiniZip and feeds it attacker-controlled archive entries. For the typical libz dependency it's noise.

    Sources: NVD · Debian security tracker.

  • 0
    Remediation · Tomáš NovákCurated

    If you genuinely bundle and use MiniZip's zipOpenNewFileInZip4_64, update to a patched MiniZip / zlib 1.3.1+. Otherwise document why the core-zlib finding doesn't apply to your build and move on.

Related CVEs

Same weakness — CWE-190 · Integer Overflow.