CVE-2023-25399

mediumpriority · track · 22EPSS 0.004 · 32 %ileDEEUNLRUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 5.5 · medium

Is it mine?

23 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Note: This is disputed as a bug and not a vulnerability. SciPy is not designed to be exposed to untrusted users or data directly.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.1–9.8

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 1.8 · impact 3.6

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-401USCWE-401USCWE-401US

affected products (23)

Products and version ranges known to be affected.

IBM Business Automation Workflow V23.0.2all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:v23.0.2
n/a n/a≤ n/aenisa_euvdEU
Canonical Ltd. Ubuntu≤ 22.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Python Software Foundation SciPy≤ 1.10.0fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
bi_publisher≤ vers:oracle/7.6.0.0.0ncsc_nlNLcpe:2.3:a:oracle:bi_publisher:7.6.0.0.0:*:*:*:*:*:*:*
bi_publisher≤ vers:oracle/7.0.0.0.0ncsc_nlNLcpe:2.3:a:oracle:bi_publisher:7.0.0.0.0:*:*:*:*:*:*:*
bi_publisher≤ vers:oracle/12.2.1.4.0ncsc_nlNLcpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*
business_intelligence≤ vers:oracle/7.6.0.0.0ncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:enterprise:*:*:*
business_intelligenceall versionsncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*
business_intelligenceall versionsncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.6.0.0.0:*:*:*:enterprise:*:*:*
business_intelligence≤ vers:oracle/12.2.1.4.0ncsc_nlNLcpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*
business_intelligence≤ vers:oracle/7.0.0.0.0ncsc_nlNLcpe:2.3:a:oracle:business_intelligence:7.0.0.0.0:*:*:*:enterprise:*:*:*
Oracle BI Publisher≤ vers:unknown/7.6.0.0.0ncsc_nlNL
Oracle BI Publisher≤ vers:unknown/12.2.1.4.0ncsc_nlNL
Oracle Oracle Business Intelligence Enterprise Edition≤ vers:oracle/6.4.0.0.0ncsc_nlNL
Oracle Corporation Oracle BI Publisher≤ vers:semver/7.6.0.0.0ncsc_nlNL

showing 20 of 23

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2025-0028Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics producten, zoals Business Intelligence, Analytics Desktop en BI Publisher.
NCSC-2025-0129Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-04-16csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Analytics.
WID-SEC-W-2024-0423IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2024-02-19csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
GHSA-9jx5-6pgf-crrpWithdrawn: scipy memory leak vulnerability2023-07-05ghsa · osvUS
## Withdrawn Advisory This advisory has been withdrawn because it has been found to not be an issue. Please see the issue [here](https://github.com/scipy/scipy/issues/16235#issuecomment-1625361328) for more information. ## Original Description A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in `Py_FindObjects()` function.
PYSEC-2023-1022023-07-05vendor · osvUS
A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl NVD CVE.org MITRE

published 2023-07-05modified 2026-06-17

references (15)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan