Home » Database

AVID-2026-R1261

Description

Heap buffer overflow in paddle.trace (CVE-2023-38671)

Details

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.

Reason for inclusion in AVID: The candidate describes a heap buffer overflow in PaddlePaddle (an AI framework) affecting versions before 2.5.0, with potential DoS and information disclosure. PaddlePaddle is a core component used to build/train/deploy AI models, making this a software vulnerability in a component used within AI pipelines. It clearly constitutes a software supply-chain-relevant vulnerability for general-purpose AI systems. The CVE and references provide explicit vulnerability details.

References

Affected or Relevant Artifacts

  • Developer: PaddlePaddle
  • Deployer: PaddlePaddle
  • Artifact Details:
TypeName
SystemPaddlePaddle

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score8.3
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🔴 High
Privileges RequiredNONE
User InteractionREQUIRED
ScopeCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-120CWE-120 Buffer Copy without Checking Size of Input (“Classic Buffer Overflow”)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-07-26
  • Version: 0.3.3
  • AVID Entry