CVE-2022-39843

    Dashboard / Vulnerabilities / CVE-2022-39843

    CVE-2022-39843

    Published: 5 Sept 2022Last Modified: 12 Aug 2026

    Summary:

    Details: 123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attackers to execute arbitrary code via a crafted worksheet. This occurs because of a stack-based buffer overflow in the cell format processing routines, as demonstrated by a certain function call from process_fmt() that can be reached via a w3r_format element in a wk3 document.

    References: https://github.com/taviso/123elf/releases/tag/v1.0.0rc3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39843.json, https://nvd.nist.gov/vuln/detail/CVE-2022-39843, https://github.com/taviso/123elf/issues/103

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -349ad68872c9faded19f9f653fbeb7ffd34451b6

    Affected versions

    v1.0.0rc2
    v1.0.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39843 | CVE-DB