Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-45853

35
FAUCET Score

CVE-2023-45853 is a critical integer overflow and heap-based buffer overflow vulnerability in MiniZip, a component not officially supported by zlib, affecting zlib versions through 1.3 and pyminizip through 0.2.6. This flaw can be triggered by a long filename, comment, or extra field during zip file operations. With a CVSS score of 9.8 (Critical), it allows for complete compromise of confidentiality, integrity, and availability with low attack complexity and no user interaction required. While there is no known active exploitation, exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered some community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.3.1CPE matchmatch criteria
cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
<= 0.2.6CPE matchmatch criteria
cpe:2.3:a:smihica:pyminizip:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.18%
Probability of exploitation in next 30 days
EPSS Percentile
86.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0318 is in the 78th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (48)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 3.1.1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.76.0-4
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 32.0-2
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.72.0-5
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: azl3 crash 8.0.4-4 on Azure Linux 3.0Fixed in: 8.0.4-2
microsoftpatch availablevia msrc
Product: azl3 nmap 7.94-1 on Azure Linux 3.0Fixed in: 7.95-1
microsoftpatch availablevia msrc
Product: azl3 zlib 1.3-1 on Azure Linux 3.0Fixed in: 1.3.1-1
microsoftpatch availablevia msrc
Product: azl3 zlib 1.3.1-1 on Azure Linux 3.0Fixed in: 1.3.1-1
microsoftpatch availablevia msrc
Product: azl3 ceph 18.2.2-8 on Azure Linux 3.0Fixed in: 18.2.2-1
microsoftpatch availablevia msrc
Product: azl3 keras 2.11.0-3 on Azure Linux 3.0Fixed in: 3.1.1-1
microsoftpatch availablevia msrc
Product: azl3 keras 3.1.1-1 on Azure Linux 3.0Fixed in: 3.1.1-1
microsoftpatch availablevia msrc
Product: cbl2 cloud-hypervisor-cvm 38.0.72.2-1 on CBL Mariner 2.0Fixed in: -
microsoftpatch availablevia msrc
Product: azl3 cloud-hypervisor-cvm 38.0.72.2-1 on Azure Linux 3.0Fixed in: -
microsoftpatch availablevia msrc
Product: cbl2 rubygem-mini_portile2 2.8.0-1 on CBL Mariner 2.0Fixed in: 2.8.0-1
microsoftpatch availablevia msrc
Product: azl3 rubygem-mini_portile2 2.8.0-1 on Azure Linux 3.0Fixed in: 2.8.0-1
microsoftpatch availablevia msrc
Product: cbl2 zlib 1.2.13-2 on CBL Mariner 2.0Fixed in: 1.2.13-2
microsoftpatch availablevia msrc
Product: cbl2 tcl 8.6.13-3 on CBL Mariner 2.0Fixed in: 8.6.13-3
microsoftpatch availablevia msrc
Product: azl3 tcl 8.6.13-3 on Azure Linux 3.0Fixed in: 8.6.13-3
microsoftpatch availablevia msrc
Product: cbl2 rust 1.72.0-5 on CBL Mariner 2.0Fixed in: 1.72.0-5
microsoftpatch availablevia msrc
Product: cbl2 cloud-hypervisor 32.0-2 on CBL Mariner 2.0Fixed in: 32.0-2
microsoftpatch availablevia msrc
Product: azl3 cloud-hypervisor 32.0-2 on Azure Linux 3.0Fixed in: 32.0-2
microsoftpatch availablevia msrc
Product: cbl2 boost 1.76.0-4 on CBL Mariner 2.0Fixed in: 1.76.0-4
microsoftpatch availablevia msrc
Product: azl3 rust 1.85.0-1 on Azure Linux 3.0Fixed in: 1.85.0-1
microsoftpatch availablevia msrc
Product: azl3 blosc 1.21.6-1 on Azure Linux 3.0Fixed in: 1.21.6-1
microsoftpatch availablevia msrc
Product: azl3 rust 1.75.0-1 on Azure Linux 3.0Fixed in: 1.75.0-1
microsoftpatch availablevia msrc
Product: azl3 rust 1.75.0-14 on Azure Linux 3.0Fixed in: 1.75.0-1
microsoftpatch availablevia msrc
Product: cbl2 cloud-hypervisor-cvm 38.0.72-1 on CBL Mariner 2.0Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: azl3 cloud-hypervisor-cvm 38.0.72-2 on Azure Linux 3.0Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: azl3 rust 1.86.0-1 on Azure Linux 3.0
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 7.95-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 1.75.0-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 3.1.1-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 7.95-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 1.75.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.76.0-4
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 32.0-2
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 38.0.72.2-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.72.0-5
nodejspatch availablevia llm_extracted
Fixed in: 25.4.0
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: zlib
View patch
gcpvendor investigatingvia llm_extracted
View patch
redhatno patchvia redhat_api
Product: Red Hat build of OpenJDK 17Fixed in: zlib
redhatend of lifevia redhat_api
Product: Red Hat build of OpenJDK 11Fixed in: zlib
redhatend of lifevia redhat_api
Product: Red Hat build of OpenJDK 1.8Fixed in: zlib

Vendor Advisories (6)

nodejsllm-nodejs-9e1762a1939f642dCRITICAL

Third-Party Package Updates in Splunk AppDynamics On-Premises Enterprise Console - August 2025

Aug 6, 2025
gcpllm-gcp-011b49b2d0496758CRITICAL

HP Universal Print Driver Series (PCL 6 and PostScript) - Potential Security Vulnerabilities

Jan 29, 2025
microsoft2024-Sep/CVE-2023-45853

CVE-2023-45853

Sep 10, 2024
pipGHSA-mq29-j5xf-cjwrcritical

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

Oct 14, 2023
redhatCVE-2023-45853Moderate

zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6

Oct 14, 2023
microsoft2023-Oct/CVE-2023-45853Critical

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename comment or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version and exposes the applicable MiniZip code through its compress API.

Oct 10, 2023

References

cert-portal.siemens.com / productcert/html/ssa-398330.html
cert-portal.siemens.com / productcert/html/ssa-470355.html
cert-portal.siemens.com / productcert/html/ssa-769027.html
chromium.googlesource.com / chromium/src/+/d709fb23806858847131027da95ef4c548813356
Mailing ListPatch
chromium.googlesource.com / chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61
Mailing ListPatch
github.com / madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib
Product
github.com / madler/zlib/pull/843
Issue TrackingPatch
lists.debian.org / debian-lts-announce/2023/11/msg00026.html
Mailing ListThird Party Advisory
pypi.org / project/pyminizip
Release Notes
security.gentoo.org / glsa/202401-18
Third Party Advisory
security.netapp.com / advisory/ntap-20231130-0009
Third Party Advisory
winimage.com / zLibDll/minizip.html
Product
openwall.com / lists/oss-security/2023/10/20/9
Mailing List
openwall.com / lists/oss-security/2024/01/24/10
Mailing List