{"id":"CVE-2026-43233","revision":"513c88f01288448989ba4c78d1da25db","records":[{"revision":"513c88f01288448989ba4c78d1da25db","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43233","aliases":[],"title":"netfilter: nf_conntrack_h323: fix OOB read in decode_choice()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from its initialization at the top of\nthe function:\n\n    unsigned int type, ext, len = 0;\n    ...\n    if (ext || (son->attr & OPEN)) {\n        BYTE_ALIGN(bs);\n        if (nf_h323_error_boundary(bs, len, 0))  /* len is 0 here */\n            return H323_ERROR_BOUND;\n        len = get_len(bs);                        /* OOB read */\n\nWhen the bitstream is exactly consumed (bs->cur == bs->end), the check\nnf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),\nwhich is false.  The subsequent get_len() call then dereferences\n*bs->cur++, reading 1 byte past the end of the buffer.  If that byte\nhas bit 7 set, get_len() reads a second byte as well.\n\nThis can be triggered remotely by sending a crafted Q.931 SETUP message\nwith a User-User Information Element containing exactly 2 bytes of\nPER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with\nthe nf_conntrack_h323 helper active.  The decoder fully consumes the\nPER buffer before reaching this code path, resulting in a 1-2 byte\nheap-buffer-overflow read confirmed by AddressSanitizer.\n\nFix this by checking for 2 bytes (the maximum that get_len() may read)\ninstead of the uninitialized `len`.  This matches the pattern used at\nevery other get_len() call site in the same file, where the caller\nchecks for 2 bytes of available data before calling get_len().","state":0,"publishedAt":"2026-05-06T11:28:29.565+00:00","modifiedAt":"2026-10-19T19:16:24.877+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_conntrack_h323_asn1.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"81f2fc5b0d0cf4696146f00f837596d10b92dead\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"7ef82863d42261817a6394c6c881bd6757a70f16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"53d32735d77ab56cc3fc7bd53a7d099418f19be1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"f0a83d0a4b7c127d32ac06d607a9214937716129\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"35f1943d242e1b9f0b6e91c0c93bfb293a9f8224\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa\",\n                            \"lessThan\": \"baed0d9ba91d4f390da12d5039128ee897253d60\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_conntrack_h323_asn1.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.252\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.202\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.165\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.128\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.75\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.16\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.6\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":8.2,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041","https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a","https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead","https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16","https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1","https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129","https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224","https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43233","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43233","identifiers":["CVE-2026-43233"]},"retained":false,"historicalAffected":[]}],"coverage":[]}