How severe is CVE-2023-6780?

CVE-2023-6780 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2023-6780 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-6780?

CVE-2023-6780 primarily affects Gnu Glibc. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-6780?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2023-6780 have an EU (EUVD) identifier?

Yes. CVE-2023-6780 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-58992.

When was CVE-2023-6780 published?

CVE-2023-6780 was published on 2024-01-31 and last updated on 2026-06-17.

CVE-2023-6780

CVE-2023-6780 is a medium-severity vulnerability in Gnu Glibc with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-131.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 3% (84th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2023-58992
Weakness: CWE-131
Affected product: Gnu Glibc
Published: 2024-01-31
Last modified: 2026-06-17

Description

An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.

Frequently asked questions

What is CVE-2023-6780?: An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size to store the message, resulting in undefined behavior. This issue affects glibc 2.37 and newer.
How severe is CVE-2023-6780?: CVE-2023-6780 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2023-6780 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-6780?: CVE-2023-6780 primarily affects Gnu Glibc. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-6780?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2023-6780 have an EU (EUVD) identifier?: Yes. CVE-2023-6780 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-58992.
When was CVE-2023-6780 published?: CVE-2023-6780 was published on 2024-01-31 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

More vulnerabilities in Gnu Glibc

CVE-2015-0235 — Critical (CVSS 10.0): Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
CVE-2026-5450 — Critical (CVSS 9.8): Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version…
CVE-2023-25139 — Critical (CVSS 9.8): sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct…
CVE-2022-23219 — Critical (CVSS 9.8): The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34…
CVE-2022-23218 — Critical (CVSS 9.8): The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34…
CVE-2021-33574 — Critical (CVSS 9.8): The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the…

All CVEs affecting Gnu Glibc →

Other CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities

CVE-2026-52955 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in…
CVE-2026-41676 — Critical (CVSS 9.8): rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78,…
CVE-2026-1949 — Critical (CVSS 9.8): Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of…
CVE-2026-20911 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and…
CVE-2025-1861 — Critical (CVSS 9.8): In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when…
CVE-2023-5941 — Critical (CVSS 9.8): In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the…

Browse all CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities →