{"cve":"CVE-2023-4273","nvd":{"published":"2023-08-09T15:15:09.823","modified":"2026-10-14T22:17:17.240","status":"Modified","description":"A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":6.7},"cwes":["CWE-787","CWE-121"],"references":["https://access.redhat.com/errata/RHSA-2023:6583","https://access.redhat.com/security/cve/CVE-2023-4273","https://bugzilla.redhat.com/show_bug.cgi?id=2221609","https://dfir.ru/2023/08/23/cve-2023-4273-a-vulnerability-in-the-linux-exfat-driver/","https://access.redhat.com/errata/RHSA-2023:6583"],"products":["debian:debian_linux","fedoraproject:fedora","linux:linux_kernel","netapp:h300s_firmware","netapp:h410s_firmware","netapp:h500s_firmware","netapp:h700s_firmware","redhat:enterprise_linux"],"source":"nvd","synced_at":"2026-10-19T21:39:14.809778102+00:00"},"epss":{"cve":"CVE-2023-4273","score":0.00648,"percentile":0.5076,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}