{"id":"CVE-2023-52389","details":"UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.","modified":"2026-08-12T13:32:47.880632Z","published":"2024-01-27T00:00:00Z","related":["openSUSE-SU-2025:15322-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52389.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/pocoproject/poco/compare/poco-1.12.5p2-release...poco-1.13.0-release"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00017.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52389.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52389"},{"type":"REPORT","url":"https://github.com/pocoproject/poco/issues/4320"},{"type":"ARTICLE","url":"https://pocoproject.org/blog/?p=1226"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pocoproject/poco","events":[{"introduced":"0"},{"fixed":"c6f27f6c96d280fad23d63271a7c9cd99ee18344"},{"introduced":"4ba8595ed83841d1fa240716b5652adc3772c36b"},{"fixed":"c04dfdbc37882f298d3178b3875cd67c38ea7d78"},{"introduced":"c6f27f6c96d280fad23d63271a7c9cd99ee18344"},{"last_affected":"c04dfdbc37882f298d3178b3875cd67c38ea7d78"}],"database_specific":{"cpe":["cpe:2.3:a:pocoproject:poco:*:*:*:*:*:*:*:*","cpe:2.3:a:pocoproject:poco:1.11.8:-:*:*:*:*:*:*","cpe:2.3:a:pocoproject:poco:1.11.8:p1:*:*:*:*:*:*","cpe:2.3:a:pocoproject:poco:1.12.5:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"1.11.8"},{"introduced":"1.12.0"},{"fixed":"1.12.5"},{"introduced":"1.11.8-NA"},{"last_affected":"1.11.8-NA"},{"introduced":"1.11.8-p1"},{"last_affected":"1.11.8-p1"},{"introduced":"1.12.5-NA"},{"last_affected":"1.12.5-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.11.8-NA","1.11.8-p1","1.12.5-NA","poco-1.12.5-release","poco-1.11.7-release","poco-1.11.6-release","poco-1.11.5-release","poco-1.11.4-release","poco-1.10.1-release","poco-1.10.0-release","poco-1.7.4-release","poco-1.7.3-release","poco-1.7.2-release","poco-1.7.1-release","poco-1.7.0-release","poco-1.6.1-release","poco-1.6.0-release","poco-1.5.3-release","poco-1.5.3-rc1","poco-1.5.2-release","poco-1.5.2-rc3","poco-1.5.2-rc2","poco-1.5.2-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52389.json","vanir_signatures_modified":"2026-08-12T13:32:47Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"126883128126587547121600965683116656677","length":1234},"id":"CVE-2023-52389-8202989a","signature_type":"Function","signature_version":"v1","source":"https://github.com/pocoproject/poco/commit/c04dfdbc37882f298d3178b3875cd67c38ea7d78","target":{"file":"Net/testsuite/src/PollSetTest.cpp","function":"PollSetTest::testPollClosedServer"}},{"signature_version":"v1","source":"https://github.com/pocoproject/poco/commit/c04dfdbc37882f298d3178b3875cd67c38ea7d78","target":{"file":"Net/testsuite/src/PollSetTest.cpp"},"deprecated":false,"digest":{"line_hashes":["166566207177569981508404787797303450977","200834539691035532703805633077402808295","227024929473728131459429144454479154318","220939589686258297239414893012708816442","84563950730046874683412812982367857665","210289698902590027770564757520703659669","260122820420695317679912485832455987026","230575208433791883324013744487275303479","125228202620450517784499599589372952081","22221409162926150470736206920339824397","91697861132533746477486978677291576093","127847113591037219025284467363185575194","11867490700539746995475217055593655826","323728365972641088151803934258321089967","2334946090901889020265750462325506786","186218063033257477311986158425325260643","220150218587801531736233715123433297489","70196389753199218269082551521150327374","264454140720801229051524741037909453475","185252031334567489262225381029448673263","218023919738659689631907406500401543586","231533809356319591876391997719220100046","122605060586929319982349802338753077278","248846186946991954874839252018121031229","254254484712003914140956962103713752941","328196513204281611578773485859840028529","203553281496114822945573639250012387323","49945010813935130229797048583749371331","232463501574571137563959329837996994918","189610670729471747632316542088090913961","292117270598071783409064335371925449355","206844497135528682449059717385280024781","275986280831851240207484963541071060196","276558151698189291298228472266322789882","22737128091337379819550154732454465992","127847113591037219025284467363185575194","70017186946833151220887989802262066825","83860233284191769754215926870225793962","219724506762597428798022305588886227394","64966893375994393306717493277879445143","157052514520566624269664472488873919570","331218745122811142535528882054067924655","69941516086681283324936602641530231088","305963931650328606558061699951284854266","142914350001098528456909098544885376181","50546443310300644483146355232184462008","20669134903330516583942087384435469298"],"threshold":0.9},"id":"CVE-2023-52389-92f17f2d","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/pocoproject/poco/commit/c04dfdbc37882f298d3178b3875cd67c38ea7d78","target":{"file":"Net/testsuite/src/PollSetTest.cpp","function":"PollSetTest::testPollNoServer"},"deprecated":false,"digest":{"length":826,"function_hash":"194312175087690824129882857276332706724"},"id":"CVE-2023-52389-e1d078c6","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}