CVE-2023-48221 - CVE House
Back to Database
Status published High CVE-2023-48221

wire-avs remote format string vulnerability

Vulnerability Description

wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format string vulnerability could potentially allow an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 9.2.22 & 9.3.5 and is already included on all Wire products. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48221

Credits & Attribution

No credits recorded in the NVD database.

References

More from wireapp

View All →
CVE-2025-49846
wire-ios accidentally logs message contents
Medium 4.1
CVE-2025-48066
wire-webapp has no database deletion on client logout
Medium 6
CVE-2025-48061
wire-webapp Has Insufficient Session Invalidation after User Logout
Medium 5.6
CVE-2023-22737
wire-server vulnerable to unauthorized removal of Bots from Conversations
Medium 6.5
CVE-2022-39380
wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering
Medium 5.3

Affected Vendor

Affected Software

wire-avs
Vulnerable Versions:
< 9.2.22, >= 9.3.0, < 9.3.5

Timeline

Official Publish: November 20th, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H

Weaknesses (CWE)

CWE-134

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.