CVE-2023-26226 - Vulnerability Details - OpenCVE

A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00063.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://yandex.com/bugbounty/i/hall-of-fame-browser/

History

Fri, 30 May 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 30 May 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description		A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
Title		A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
Weaknesses		CWE-416
References		https://yandex.com/bugbounty/i/hall-of-fame-browser/
Metrics		cvssV4_0 `{'score': 7.4, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: yandex

Published: 2025-05-30T17:23:54.571Z

Updated: 2025-05-30T17:48:16.518Z

Reserved: 2023-02-20T22:19:35.320Z

Link: CVE-2023-26226

Vulnrichment

Updated: 2025-05-30T17:48:11.853Z

NVD

Status : Awaiting Analysis

Published: 2025-05-30T18:15:32.283

Modified: 2025-06-02T17:32:17.397

Link: CVE-2023-26226

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26226", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "state": "PUBLISHED", "assignerShortName": "yandex", "dateReserved": "2023-02-20T22:19:35.320Z", "datePublished": "2025-05-30T17:23:54.571Z", "dateUpdated": "2025-05-30T17:48:16.518Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS"], "product": "Browser", "vendor": "Yandex", "versions": [{"lessThan": "24.4.0.682", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "khangkito"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682"}], "value": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.4, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-05-30T17:23:54.571Z"}, "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-browser/"}], "source": {"discovery": "UNKNOWN"}, "title": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-30T17:48:08.779287Z", "id": "CVE-2023-26226", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T17:48:16.518Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26226", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-30T17:48:08.779287Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-30T17:48:11.853Z"}}], "cna": {"title": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "khangkito"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Yandex", "product": "Browser", "versions": [{"status": "affected", "version": "0", "lessThan": "24.4.0.682", "versionType": "custom"}], "platforms": ["Windows", "MacOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://yandex.com/bugbounty/i/hall-of-fame-browser/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682", "supportingMedia": [{"type": "text/html", "value": "A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "a51c9250-e584-488d-808b-03e6f1386796", "shortName": "yandex", "dateUpdated": "2025-05-30T17:23:54.571Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26226", "state": "PUBLISHED", "dateUpdated": "2025-05-30T17:48:16.518Z", "dateReserved": "2023-02-20T22:19:35.320Z", "assignerOrgId": "a51c9250-e584-488d-808b-03e6f1386796", "datePublished": "2025-05-30T17:23:54.571Z", "assignerShortName": "yandex"}, "dataVersion": "5.1"}