Protection mechanism failure in LuaTeX - CVE-2023-32668

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU118762

Protection mechanism failure in LuaTeX - CVE-2023-32668

Published: November 25, 2025


Vulnerability identifier: #VU118762
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-32668
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the application allows a document (compiled with the default settings) to make arbitrary network requests. A remote attacker can trick the victim into opening a specially crafted document and gain access to sensitive information. 


Affected software

LuaTeX
MikTex
texlive
openEuler
texlive-lyluatex
texlive-latexfileversion
texlive-oberdiek
texlive-latexindent
texlive-latexpand
texlive-lilyglyphs
texlive-listbib
texlive-listings-ext
texlive-lollipop
texlive-ltxfileinfo
texlive-ltximg
texlive-luaotfload
texlive-lwarp
texlive-make4ht
texlive-makedtx
texlive-match_parens
texlive-mathspic
texlive-mex
texlive-mf2pt1
texlive-mkgrkindex
texlive-mkjobtexmf
texlive-mkpic
texlive-mltex
texlive-mptopdf
texlive-multibibliography
texlive-musixtex
texlive-dviinfox
texlive-glossaries
texlive-yplan
texlive-ebong
texlive-eplain
texlive-epspdf
texlive-epstopdf
texlive-exceltex
texlive-fig4latex
texlive-findhyph
texlive-fontinst
texlive-fontools
texlive-fragmaster
texlive-getmap
texlive-latexdiff
texlive-glyphlist
texlive-installfont
texlive-jadetex
texlive-jfmutil
texlive-ketcindy
texlive-kotex-utils
texlive-l3build
texlive-latex
texlive-latex-git-log
texlive-latex-papersize
texlive-latex2man
texlive-latex2nemeth
texlive-texosquery
texlive-texcount
texlive-texdef
texlive-texdiff
texlive-texdirflatten
texlive-texdoc
texlive-texdoctk
texlive-texfot
texlive-texlive-en
texlive-texlive-scripts
texlive-texlive-scripts-extra
texlive-texlive.infra
texlive-texliveonfly
texlive-texloganalyser
texlive-tex4ebook
texlive-texplate
texlive-texsis
texlive-thumbpdf
texlive-tpic2pdftex
texlive-typeoutfileinfo
texlive-ulqda
texlive-urlbst
texlive-vpe
texlive-webquiz
texlive-wordcount
texlive-xindex
texlive-xmltex
texlive-pmxchords
texlive-pdfbook2
texlive-pdfcrop
texlive-pdfjam
texlive-pdflatexpicscale
texlive-pdftex-quiet
texlive-pdfxup
texlive-pedigree-perl
texlive-perltex
texlive-petri-nets
texlive-pfarrei
texlive-pkfix
texlive-pkfix-helper
texlive-pax
texlive-pst-pdf
texlive-pst2pdf
texlive-ptex-fontmaps
texlive-ptex2pdf
texlive-purifyeps
texlive-pygmentex
texlive-pythontex
texlive-rubik
texlive-splitindex
texlive-srcredact
texlive-sty2dtx
texlive-svn-multi
texlive-luahbtex
texlive-dvips
texlive-dvisvgm
texlive-fontware
texlive-git-latexdiff
texlive-gregoriotex
texlive-gsftopk
texlive-hyperxmp
texlive-kpathsea
texlive-lacheck
texlive-lcdftypetools
texlive-lib
texlive-lib-devel
texlive-light-latex-make
texlive-dvipos
texlive-luajittex
texlive-luatex
texlive-m-tx
texlive-makeindex
texlive-metafont
texlive-metapost
texlive-mflua
texlive-mfware
texlive-musixtnt
texlive-omegaware
texlive-optex
texlive-patgen
texlive-cjkutils
texlive-base
texlive-afm2pl
texlive-albatross
texlive-aleph
texlive-autosp
texlive-axodraw2
texlive-base-debuginfo
texlive-base-debugsource
texlive-bibtex
texlive-bibtex8
texlive-bibtexu
texlive-chktex
texlive-pdftex
texlive-context-doc
texlive-ctie
texlive-cweb
texlive-detex
texlive-dtl
texlive-dvi2tty
texlive-dvicopy
texlive-dvidvi
texlive-dviljk
texlive-dviout-util
texlive-dvipdfmx
texlive-dvipng
texlive-convbkmk
texlive-arara
texlive-attachfile2
texlive-authorindex
texlive-bib2gls
texlive-bibexport
texlive-bundledoc
texlive-cachepic
texlive-checkcites
texlive-checklistings
texlive-chklref
texlive-clojure-pamphlet
texlive-cluttex
texlive-context
texlive-amstex
texlive-crossrefware
texlive-cslatex
texlive-csplain
texlive-ctan-o-mat
texlive-ctanbib
texlive-ctanify
texlive-ctanupload
texlive-cyrillic
texlive-de-macro
texlive-diadia
texlive-dosepsbin
texlive-dtxgen
texlive-tikztosvg
texlive-pdftosrc
texlive-pmx
texlive-ps2eps
texlive-ps2pk
texlive-ptex
texlive-seetexk
texlive-spix
texlive-synctex
texlive-tex
texlive-tex4ht
texlive-texware
texlive-tie
texlive-dviasm
texlive-ttfutils
texlive-uptex
texlive-velthuis
texlive-vlna
texlive-web
texlive-xdvi
texlive-xetex
texlive-xml2pmx
texlive-xpdfopen
texlive-a2ping
texlive-accfonts
texlive-adhocfilelist

How to mitigate CVE-2023-32668

Install updates from vendor's website.

LuaTeX - update to 1.17.0
MikTex - update to 23.5
texlive - update to 66984
texlive-lyluatex - update to svn47584-12
texlive-latexfileversion - update to 20210325-12
texlive-oberdiek - update to 20210325-12
texlive-latexindent - update to 20210325-12
texlive-latexpand - update to 20210325-12
texlive-lilyglyphs - update to 20210325-12
texlive-listbib - update to 20210325-12
texlive-listings-ext - update to 20210325-12
texlive-lollipop - update to 20210325-12
texlive-ltxfileinfo - update to 20210325-12
texlive-ltximg - update to 20210325-12
texlive-luaotfload - update to 20210325-12
texlive-lwarp - update to 20210325-12
texlive-make4ht - update to 20210325-12
texlive-makedtx - update to 20210325-12
texlive-match_parens - update to 20210325-12
texlive-mathspic - update to 20210325-12
texlive-mex - update to 20210325-12
texlive-mf2pt1 - update to 20210325-12
texlive-mkgrkindex - update to 20210325-12
texlive-mkjobtexmf - update to 20210325-12
texlive-mkpic - update to 20210325-12
texlive-mltex - update to 20210325-12
texlive-mptopdf - update to 20210325-12
texlive-multibibliography - update to 20210325-12
texlive-musixtex - update to 20210325-12
texlive-dviinfox - update to 20210325-12
texlive-glossaries - update to 20210325-12
texlive-yplan - update to 20210325-12
texlive-ebong - update to 20210325-12
texlive-eplain - update to 20210325-12
texlive-epspdf - update to 20210325-12
texlive-epstopdf - update to 20210325-12
texlive-exceltex - update to 20210325-12
texlive-fig4latex - update to 20210325-12
texlive-findhyph - update to 20210325-12
texlive-fontinst - update to 20210325-12
texlive-fontools - update to 20210325-12
texlive-fragmaster - update to 20210325-12
texlive-getmap - update to 20210325-12
texlive-latexdiff - update to 20210325-12
texlive-glyphlist - update to 20210325-12
texlive-installfont - update to 20210325-12
texlive-jadetex - update to 20210325-12
texlive-jfmutil - update to 20210325-12
texlive-ketcindy - update to 20210325-12
texlive-kotex-utils - update to 20210325-12
texlive-l3build - update to 20210325-12
texlive-latex - update to 20210325-12
texlive-latex-git-log - update to 20210325-12
texlive-latex-papersize - update to 20210325-12
texlive-latex2man - update to 20210325-12
texlive-latex2nemeth - update to 20210325-12
texlive-texosquery - update to 20210325-12
texlive-texcount - update to 20210325-12
texlive-texdef - update to 20210325-12
texlive-texdiff - update to 20210325-12
texlive-texdirflatten - update to 20210325-12
texlive-texdoc - update to 20210325-12
texlive-texdoctk - update to 20210325-12
texlive-texfot - update to 20210325-12
texlive-texlive-en - update to 20210325-12
texlive-texlive-scripts - update to 20210325-12
texlive-texlive-scripts-extra - update to 20210325-12
texlive-texlive.infra - update to 20210325-12
texlive-texliveonfly - update to 20210325-12
texlive-texloganalyser - update to 20210325-12
texlive-tex4ebook - update to 20210325-12
texlive-texplate - update to 20210325-12
texlive-texsis - update to 20210325-12
texlive-thumbpdf - update to 20210325-12
texlive-tpic2pdftex - update to 20210325-12
texlive-typeoutfileinfo - update to 20210325-12
texlive-ulqda - update to 20210325-12
texlive-urlbst - update to 20210325-12
texlive-vpe - update to 20210325-12
texlive-webquiz - update to 20210325-12
texlive-wordcount - update to 20210325-12
texlive-xindex - update to 20210325-12
texlive-xmltex - update to 20210325-12
texlive-pmxchords - update to 20210325-12
texlive-pdfbook2 - update to 20210325-12
texlive-pdfcrop - update to 20210325-12
texlive-pdfjam - update to 20210325-12
texlive-pdflatexpicscale - update to 20210325-12
texlive-pdftex-quiet - update to 20210325-12
texlive-pdfxup - update to 20210325-12
texlive-pedigree-perl - update to 20210325-12
texlive-perltex - update to 20210325-12
texlive-petri-nets - update to 20210325-12
texlive-pfarrei - update to 20210325-12
texlive-pkfix - update to 20210325-12
texlive-pkfix-helper - update to 20210325-12
texlive-pax - update to 20210325-12
texlive-pst-pdf - update to 20210325-12
texlive-pst2pdf - update to 20210325-12
texlive-ptex-fontmaps - update to 20210325-12
texlive-ptex2pdf - update to 20210325-12
texlive-purifyeps - update to 20210325-12
texlive-pygmentex - update to 20210325-12
texlive-pythontex - update to 20210325-12
texlive-rubik - update to 20210325-12
texlive-splitindex - update to 20210325-12
texlive-srcredact - update to 20210325-12
texlive-sty2dtx - update to 20210325-12
texlive-svn-multi - update to 20210325-12
texlive-luahbtex - update to 20210325-12
texlive-dvips - update to 20210325-12
texlive-dvisvgm - update to 20210325-12
texlive-fontware - update to 20210325-12
texlive-git-latexdiff - update to 20210325-12
texlive-gregoriotex - update to 20210325-12
texlive-gsftopk - update to 20210325-12
texlive-hyperxmp - update to 20210325-12
texlive-kpathsea - update to 20210325-12
texlive-lacheck - update to 20210325-12
texlive-lcdftypetools - update to 20210325-12
texlive-lib - update to 20210325-12
texlive-lib-devel - update to 20210325-12
texlive-light-latex-make - update to 20210325-12
texlive-dvipos - update to 20210325-12
texlive-luajittex - update to 20210325-12
texlive-luatex - update to 20210325-12
texlive-m-tx - update to 20210325-12
texlive-makeindex - update to 20210325-12
texlive-metafont - update to 20210325-12
texlive-metapost - update to 20210325-12
texlive-mflua - update to 20210325-12
texlive-mfware - update to 20210325-12
texlive-musixtnt - update to 20210325-12
texlive-omegaware - update to 20210325-12
texlive-optex - update to 20210325-12
texlive-patgen - update to 20210325-12
texlive-cjkutils - update to 20210325-12
texlive-base - update to 20210325-12
texlive-afm2pl - update to 20210325-12
texlive-albatross - update to 20210325-12
texlive-aleph - update to 20210325-12
texlive-autosp - update to 20210325-12
texlive-axodraw2 - update to 20210325-12
texlive-base-debuginfo - update to 20210325-12
texlive-base-debugsource - update to 20210325-12
texlive-bibtex - update to 20210325-12
texlive-bibtex8 - update to 20210325-12
texlive-bibtexu - update to 20210325-12
texlive-chktex - update to 20210325-12
texlive-pdftex - update to 20210325-12
texlive-context-doc - update to 20210325-12
texlive-ctie - update to 20210325-12
texlive-cweb - update to 20210325-12
texlive-detex - update to 20210325-12
texlive-dtl - update to 20210325-12
texlive-dvi2tty - update to 20210325-12
texlive-dvicopy - update to 20210325-12
texlive-dvidvi - update to 20210325-12
texlive-dviljk - update to 20210325-12
texlive-dviout-util - update to 20210325-12
texlive-dvipdfmx - update to 20210325-12
texlive-dvipng - update to 20210325-12
texlive-convbkmk - update to 20210325-12
texlive-arara - update to 20210325-12
texlive-attachfile2 - update to 20210325-12
texlive-authorindex - update to 20210325-12
texlive-bib2gls - update to 20210325-12
texlive-bibexport - update to 20210325-12
texlive-bundledoc - update to 20210325-12
texlive-cachepic - update to 20210325-12
texlive-checkcites - update to 20210325-12
texlive-checklistings - update to 20210325-12
texlive-chklref - update to 20210325-12
texlive-clojure-pamphlet - update to 20210325-12
texlive-cluttex - update to 20210325-12
texlive-context - update to 20210325-12
texlive-amstex - update to 20210325-12
texlive-crossrefware - update to 20210325-12
texlive-cslatex - update to 20210325-12
texlive-csplain - update to 20210325-12
texlive-ctan-o-mat - update to 20210325-12
texlive-ctanbib - update to 20210325-12
texlive-ctanify - update to 20210325-12
texlive-ctanupload - update to 20210325-12
texlive-cyrillic - update to 20210325-12
texlive-de-macro - update to 20210325-12
texlive-diadia - update to 20210325-12
texlive-dosepsbin - update to 20210325-12
texlive-dtxgen - update to 20210325-12
texlive-tikztosvg - update to 20210325-12
texlive-pdftosrc - update to 20210325-12
texlive-pmx - update to 20210325-12
texlive-ps2eps - update to 20210325-12
texlive-ps2pk - update to 20210325-12
texlive-ptex - update to 20210325-12
texlive-seetexk - update to 20210325-12
texlive-spix - update to 20210325-12
texlive-synctex - update to 20210325-12
texlive-tex - update to 20210325-12
texlive-tex4ht - update to 20210325-12
texlive-texware - update to 20210325-12
texlive-tie - update to 20210325-12
texlive-dviasm - update to 20210325-12
texlive-ttfutils - update to 20210325-12
texlive-uptex - update to 20210325-12
texlive-velthuis - update to 20210325-12
texlive-vlna - update to 20210325-12
texlive-web - update to 20210325-12
texlive-xdvi - update to 20210325-12
texlive-xetex - update to 20210325-12
texlive-xml2pmx - update to 20210325-12
texlive-xpdfopen - update to 20210325-12
texlive-a2ping - update to 20210325-12
texlive-accfonts - update to 20210325-12
texlive-adhocfilelist - update to 20210325-12

External References

Related Security Bulletins