{"id":"CVE-2026-43233","title":"netfilter: nf_conntrack_h323: fix OOB read in decode_choice()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from it…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 81f2fc5b0d0cf4696146f00f837596d10b92dead","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 7ef82863d42261817a6394c6c881bd6757a70f16","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 53d32735d77ab56cc3fc7bd53a7d099418f19be1","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < f0a83d0a4b7c127d32ac06d607a9214937716129","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224","Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < baed0d9ba91d4f390da12d5039128ee897253d60","Linux 4.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:15:55.935171Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:37.301Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43233","references":[{"url":"https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041"},{"url":"https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a"},{"url":"https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead"},{"url":"https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16"},{"url":"https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1"},{"url":"https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129"},{"url":"https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224"},{"url":"https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60"}],"tags":["cve.org"],"epss":0.00463,"epssPercentile":0.38686,"ingestedAt":"2026-10-16T17:24:46.688Z","slug":"CVE-2026-43233","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from its initialization at the top of\nthe function:\n\n    unsigned int type, ext, len = 0;\n    ...\n    if (ext || (son->attr & OPEN)) {\n        BYTE_ALIGN(bs);\n        if (nf_h323_error_boundary(bs, len, 0))  /* len is 0 here */\n            return H323_ERROR_BOUND;\n        len = get_len(bs);                        /* OOB read */\n\nWhen the bitstream is exactly consumed (bs->cur == bs->end), the check\nnf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),\nwhich is false.  The subsequent get_len() call then dereferences\n*bs->cur++, reading 1 byte past the end of the buffer.  If that byte\nhas bit 7 set, get_len() reads a second byte as well.\n\nThis can be triggered remotely by sending a crafted Q.931 SETUP message\nwith a User-User Information Element containing exactly 2 bytes of\nPER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with\nthe nf_conntrack_h323 helper active.  The decoder fully consumes the\nPER buffer before reaching this code path, resulting in a 1-2 byte\nheap-buffer-overflow read confirmed by AddressSanitizer.\n\nFix this by checking for 2 bytes (the maximum that get_len() may read)\ninstead of the uninitialized `len`.  This matches the pattern used at\nevery other get_len() call site in the same file, where the caller\nchecks for 2 bytes of available data before calling get_len().\n\n## Affected\n\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 81f2fc5b0d0cf4696146f00f837596d10b92dead`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 7ef82863d42261817a6394c6c881bd6757a70f16`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 53d32735d77ab56cc3fc7bd53a7d099418f19be1`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < f0a83d0a4b7c127d32ac06d607a9214937716129`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224`\n- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < baed0d9ba91d4f390da12d5039128ee897253d60`\n- `Linux 4.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}