CVE-2023-33733

highpriority · track · 42EPSS 0.021 · 82 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

2.12% (82nd) EPSS

CVSS 7.8 · high

Is it mine?

13 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · OSV

v3.17.4highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94USCWE-94USCWE-94US

exploits (5)

Public proof-of-concept and weaponised exploit code.

L41KAA/CVE-2023-33733-Exploit-PoCL41KAA/CVE-2023-33733-Exploit-PoCPoC · poc_in_github
buiduchoang24/CVE-2023-33733This project aims at re-analyzing and PoC about CVE-2023-33733. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. PoC · poc_in_github
c53elyas/CVE-2023-33733CVE-2023-33733 reportlab RCEPoC · poc_in_github
hoangbui24/CVE-2023-33733Reportlab Library - Remote Code ExecutionPoC · poc_in_github
onion2203/Lab_ReportlabThis lab was set up to test CVE-2023-33733PoC · poc_in_github

affected products (13)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Splunk Splunk Enterprise <9.0.10all versionscert_bundDE
Splunk Splunk Enterprise <9.1.5all versionscert_bundDE
Splunk Splunk Enterprise <9.2.2all versionscert_bundDE
Splunk Splunk Enterprise< 9.0.10cert_bundDE
Splunk Splunk Enterprise< 9.1.5cert_bundDE
Splunk Splunk Enterprise< 9.2.2cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Matthias Klose ReportLab≤ 3.6.13fstec_bduRU
АО «ИВК» АЛЬТ СП 10all versionsfstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
reportlab reportlab≤ 3.6.12nvdUScpe:2.3:a:reportlab:reportlab:*:*:*:*:*:*:*:*
PyPI reportlab< 3.6.13osvUSpkg:pypi/reportlab

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1494Splunk Enterprise: Mehrere SchwachstellenDeutsch2024-07-01csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Splunk Enterprise ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, mehrere Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen preiszugeben
GHSA-9q9m-c65c-37pqReportlab vulnerable to remote code execution2023-06-05ghsa · osvUS
Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
PYSEC-2026-1871Reportlab vulnerable to remote code execution2026-07-07vendor · osvUS
Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2023-06-05modified 2026-06-17

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan