CVE-2023-41375 json
Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0.
published 2023-09-20 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-45877
- cvss
- 7.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.
Patch / fix
- jtekt kostac_plc 1.6.10.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- JTEKT ELECTRONICS CORPORATION Kostac PLC Programming Software
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
electronics.jtekt.co.jp
/en/topics/202309125391/
vendor-advisory
-
jvn.jp
/en/vu/JVNVU95282683/index.html
third-party-advisory
Sources
- CVE List CVE-2023-41375
- NVD CVE-2023-41375
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.