CVE-2023-49991 - OpenCVE

Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Espeak-ng	Espeak-ng

Configuration 1 [-]

cpe:2.3:a:espeak-ng:espeak-ng:1.52:dev:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/espeak-ng/espeak-ng/issues/1825
https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
https://lists.fedoraproject.org/archives/list/[email protected]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/
https://lists.fedoraproject.org/archives/list/[email protected]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/
https://nvd.nist.gov/vuln/detail/CVE-2023-49991
https://www.cve.org/CVERecord?id=CVE-2023-49991

History

Tue, 04 Nov 2025 19:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.fedoraproject.org/archives/list/[email protected]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/ https://lists.fedoraproject.org/archives/list/[email protected]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/

Mon, 03 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html

Tue, 26 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-12-12T00:00:00.000Z

Updated: 2025-11-04T18:20:21.377Z

Reserved: 2023-12-04T00:00:00.000Z

Link: CVE-2023-49991

Vulnrichment

Updated: 2025-11-04T18:20:21.377Z

NVD

Status : Modified

Published: 2023-12-12T14:15:07.600

Modified: 2025-11-04T19:16:12.997

Link: CVE-2023-49991

Redhat

Severity : Moderate

Publid Date: 2023-12-12T00:00:00Z

Links: CVE-2023-49991 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-49991", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-11-04T18:20:21.377Z", "dateReserved": "2023-12-04T00:00:00.000Z", "datePublished": "2023-12-12T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-01-19T04:06:55.307Z"}, "descriptions": [{"lang": "en", "value": "Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/espeak-ng/espeak-ng/issues/1825"}, {"name": "FEDORA-2024-5661c87b25", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}, {"name": "FEDORA-2024-698737a3c5", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/espeak-ng/espeak-ng/issues/1825", "tags": ["x_transferred"]}, {"name": "FEDORA-2024-5661c87b25", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}, {"name": "FEDORA-2024-698737a3c5", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T18:20:21.377Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-26T16:40:51.179706Z", "id": "CVE-2023-49991", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T16:41:02.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/espeak-ng/espeak-ng/issues/1825", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/", "name": "FEDORA-2024-5661c87b25", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/", "name": "FEDORA-2024-698737a3c5", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T18:20:21.377Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-49991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-26T16:40:51.179706Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-26T16:40:56.574Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/espeak-ng/espeak-ng/issues/1825"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/", "name": "FEDORA-2024-5661c87b25", "tags": ["vendor-advisory"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/", "name": "FEDORA-2024-698737a3c5", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-01-19T04:06:55.307Z"}}}, "cveMetadata": {"cveId": "CVE-2023-49991", "state": "PUBLISHED", "dateUpdated": "2025-11-04T18:20:21.377Z", "dateReserved": "2023-12-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-12-12T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:espeak-ng:espeak-ng:1.52:dev:*:*:*:*:*:*", "matchCriteriaId": "B073B0F6-3979-4E7D-BF6F-29C9EB1F3480", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c."}, {"lang": "es", "value": "Se descubri\u00f3 que Espeak-ng 1.52-dev contiene un desbordamiento del b\u00fafer a trav\u00e9s de la funci\u00f3n CountVowelPosition en synthdata.c."}], "id": "CVE-2023-49991", "lastModified": "2025-11-04T19:16:12.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-12-12T14:15:07.600", "references": [{"source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/espeak-ng/espeak-ng/issues/1825"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/espeak-ng/espeak-ng/issues/1825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00050.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/2PZEBWPNKPAYJMIM3AS2RP3FL6FX3HS4/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/Z5WW6RKHRWLEMCKCQ6UZCXWC5J7UWMUQ/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}