CVE-2023-38651

What it actually does

Integer overflow in VZT vzt_rd_block_vch_decode times parsing when num_time_ticks is zero leads to memory corruption.

Why it matters to the business

Attackers can achieve memory corruption and potential code execution on user systems by tricking victims into opening malicious files; available public exploit increases risk for organizations using affected software versions despite low EPSS and no KEV listing.

How an attack unfolds

An attacker creates a specially crafted .vzt file that triggers an integer overflow in the times parsing path when num_time_ticks is zero, causing memory corruption; the victim opens the file in the vulnerable application to trigger the flaw.

How to fix it

Upgrade hashicorp/vault (GIT) to commit d93899cf3e387f6ba4448953d9347571d819de62.

How to confirm the fix worked

Confirm the software version or commit hash matches the fixed commit d93899cf3e387f6ba4448953d9347571d819de62 and test parsing of crafted VZT files with num_time_ticks set to zero.

Typical attack path

1. Craft malicious .vzt file with zero num_time_ticks value to trigger overflow
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable application
4. Exploit memory corruption for code execution or denial of service

How to detect it

Review application logs and file access records for unexpected VZT file opens; look for crashes or memory errors during file parsing shortly after file access.

What your security team should do

• Immediately upgrade all instances of the affected software to the listed fixed commit
• Block opening of untrusted .vzt files until patches are applied
• Monitor for new exploit code and update detection rules
• Review file handling policies for waveform or similar data files