Threat database

CVE-2023-43641 is a high-severity out-of-bounds write vulnerability in libcue versions 2.2.1 and earlier. Libcue is used to parse CUE sheet files, commonly handled by GNOME desktop environments through tracker-miners. When a maliciously crafted . cue file is downloaded and saved to the user's Downloads folder, tracker-miners automatically scan and parse it using libcue, triggering the vulnerability. This can lead to remote code execution without requiring prior authentication, only user interaction to download the file. The vulnerability impacts confidentiality, integrity, and availability of affected systems. It is patched in libcue version 2.3.