CVE-2023-33476: readymedia_project readymedia Out-of-bounds Write
Vulnerability summary
CVE-2023-33476 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in readymedia_project readymedia. EPSS estimates a 2.06% chance of exploitation in the next 30 days, higher than 81% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 02-06-2023PublishedVulnerability first disclosed.
- 08-01-2025Last modifiedVulnerability information updated.
Description
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.06%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.06% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blog.coffinsec.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Opensuse2 products
- minidlna&distro=openSUSE Leap 15.5< 1.3.3-bp155.2.3.1
- minidlna&distro=openSUSE Tumbleweed< 1.3.3-2.1
Debian1 product
- minidlna< 1.3.2+dfsg-1.1 | < 1.3.0+dfsg-2+deb11u2 | < 1.3.0+dfsg-2.2+deb12u1 | < 1.2.1+dfsg-2+deb10u4
Mageia1 product
- minidlna< 1.3.3-1.mga8
Readymedia_project1 product
- readymedia≥ 1.1.15, ≤ 1.3.2
Suse1 product
- minidlna&distro=SUSE Package Hub 15 SP5< 1.3.3-bp155.2.3.1
Ubuntu1 product
- minidlna< 1.1.5+dfsg-2ubuntu0.1+esm1 | < 1.2.1+dfsg-1ubuntu0.18.04.1+esm1 | < 1.2.1+dfsg-1ubuntu0.20.04.2 | < 1.3.0+dfsg-2.1ubuntu0.1
6 vendors · 7 products
References
15 links
- security.gentoo.org/glsa/202311-12Vendor Advisory
- lists.opensuse.org/archives/…Advisory