CVE-2023-43641: Debian Linux

High severity, CVSS 8.8. EPSS: 18.1% chance of exploitation in the next 30 days.

libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only; version 12.0 only
• Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
• Lipnitsk Libcue: before 2.3.0 (fixed in 2.3.0)

Published 2023-10-09. Last modified 2026-06-17.