CVE-2026-43233 | netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() In decode_choice(), the boundary check before get_len() uses the variable `len`, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = 0; ... if (ext || (son->attr & OPEN)) { BYTE_ALIGN(bs); if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */ return H323_ERROR_BOUND; len = get_len(bs); /* OOB read */ When the bitstream is exactly consumed (bs->cur == bs->end), the check nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end), which is false. The subsequent get_len() call then dereferences *bs->cur++, reading 1 byte past the end of the buffer. If that byte has bit 7 set, get_len() reads a second byte as well. This can be triggered remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nf_conntrack_h323 helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a 1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer. Fix this by checking for 2 bytes (the maximum that get_len() may read) instead of the uninitialized `len`. This matches the pattern used at every other get_len() call site in the same file, where the caller checks for 2 bytes of available data before calling get_len().

Published: 2026-05-06 Last update: 2026-06-17 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-43233 is rated Moderate Risk (45.9/100): CVSS High severity, with low exploitation likelihood (EPSS 0.46%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-43233

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.05% 0.46% +0.41%
2 2026-05-09 0.02% 0.05% +0.03%
3 2026-05-07 — 0.02% —

Full EPSS history (3 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-43233

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.2 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 4.2 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Weakness enumeration for CVE-2026-43233

GitHub Security Advisory for CVE-2026-43233

GHSA-qx8f-4v7p-9m35 · Severity: high — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323...

OS Trackers for CVE-2026-43233

vendor priority summary link
debian not yet assigned CVE-2026-43233 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2026-43233
redhat medium — https://access.redhat.com/security/cve/CVE-2026-43233
suse medium — https://www.suse.com/security/cve/CVE-2026-43233/
ubuntu medium CVE-2026-43233 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 170, needed 125, released 83, not-affected 17, needs-triage 5, pending 1. https://ubuntu.com/security/CVE-2026-43233

Affected software / configurations for CVE-2026-43233

Vendor Product Version Raw CPE
linux linux_kernel >= 4.15.1, < 5.10.252 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.11, < 5.15.202 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 5.16, < 6.1.165 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.2, < 6.6.128 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.7, < 6.12.75 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.13, < 6.18.16 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.19, < 6.19.6 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc4:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc5:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc6:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc7:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc8:*:*:*:*:*:*
linux linux_kernel 4.15 cpe:2.3:o:linux:linux_kernel:4.15:rc9:*:*:*:*:*:*
linux linux_kernel 7.0 cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*

References for CVE-2026-43233

cvelogic Threat Intelligence