{"id":"CVE-2023-33865","details":"RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.","modified":"2026-09-30T14:03:44.656606Z","published":"2023-06-07T00:00:00Z","related":["openSUSE-SU-2023:0253-1","openSUSE-SU-2024:12986-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33865.json","unresolved_ranges":[{"source":"DESCRIPTION","extracted_events":[{"fixed":"1.27"}]}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00008.html"},{"type":"WEB","url":"https://renderdoc.org/"},{"type":"WEB","url":"https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txt"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33865.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33865"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202311-10"},{"type":"ARTICLE","url":"http://seclists.org/fulldisclosure/2023/Jun/2"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/baldurk/renderdoc","events":[{"introduced":"0"},{"fixed":"35b13a8e8fd2a331854dba6da81a20452e142d6f"}],"database_specific":{"cpe":"cpe:2.3:a:renderdoc:renderdoc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.27"}],"source":"CPE_RANGE"}}],"versions":["v1.26","v1.25","v1.24","v1.23","v1.22","v1.21","v1.20","v1.19","v1.18","v1.17","v1.16","v1.15","v1.14","v1.13","v1.12","v1.11","v1.10","v1.9","v1.8","v1.7","v1.6","v1.5","v1.4","v1.3","v1.2","v1.1","v1.0","v0.34","v0.33","v0.32","v0.31","v0.30","v0.29","v0.28","v0.27","v0.26","v0.25","v0.24","v0.23","v0.22","v0.21","v0.20"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33865.json","vanir_signatures_modified":"2026-09-30T14:03:44Z","vanir_signatures":[{"digest":{"length":5629,"function_hash":"207031362872400018630550390413264789883"},"id":"CVE-2023-33865-88f44e2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/baldurk/renderdoc/commit/35b13a8e8fd2a331854dba6da81a20452e142d6f","target":{"file":"renderdoc/driver/d3d12/d3d12_initstate.cpp","function":"D3D12ResourceManager::Apply_InitialState"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["246391024811821595621320454956405206461","85610304483816474240875822929362604062","283988233817170691411233645964645644213","158616652955883617395273378505774283181","256823133942610002150282782064269407498","322935392101701815173461239667259771593","117576242339930017018975712117044188594","244306145736225365563097097248471708603","268191887078762735774990035206401820441","325612000740066105718408348044896797885","97946356204737987662100599910719312420","221653629284929379356025328144561411117"],"threshold":0.9},"id":"CVE-2023-33865-98059e92","signature_type":"Line","signature_version":"v1","source":"https://github.com/baldurk/renderdoc/commit/35b13a8e8fd2a331854dba6da81a20452e142d6f","target":{"file":"renderdoc/driver/d3d12/d3d12_initstate.cpp"}},{"source":"https://github.com/baldurk/renderdoc/commit/35b13a8e8fd2a331854dba6da81a20452e142d6f","target":{"function":"D3D12ResourceManager::Prepare_InitialState","file":"renderdoc/driver/d3d12/d3d12_initstate.cpp"},"deprecated":false,"digest":{"function_hash":"37754596934205908856414035410048059726","length":7688},"id":"CVE-2023-33865-fdd28f2e","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}