CVE-2023-48298: Integer underflow leading to stack overflow in FPC codec decompression
Vulnerability summary
CVE-2023-48298 is a high (CVSS 7.5) Integer Underflow (Wrap or Wraparound) vulnerability in clickhouse. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities.
Timeline
- 21-12-2023PublishedVulnerability first disclosed.
- 27-11-2024Last modifiedVulnerability information updated.
Description
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.63% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Clickhouse2 products
- clickhouse≤ 23.10.2.14 | ≥ 23.3, ≤ 23.3.17.13 | ≥ 23.8, ≤ 23.8.7.24 | ≥ 23.9, ≤ 23.9.5.29 | ≥ 23.10, ≤ 23.10.4.25
- clickhouse_cloud≥ 23.9, ≤ 23.9.2.47475
Ubuntu1 product
- clickhouseAll versions (No fix recorded)
2 vendors · 3 products
References
4 links- github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938X Refsource CONFIRMREPORTVendor Advisory