Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-44428

Summary

The vulnerability relates to the MuseScore application's handling of CAP files, where the absence of appropriate length validation for user-provided data leads to a heap-based buffer overflow. This flaw potentially allows remote attackers to execute arbitrary code on affected systems, contingent upon user interaction such as visiting a malicious webpage or opening a specially crafted file. By exploiting this weakness, an attacker could run unauthorized commands within the context of the currently executing process, posing significant security risks to users.

References