CVE-2023-28903

Description

An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.

Reserved 2023-03-27 | Published 2025-06-28 | Updated 2025-06-28 | Assigner ASRG

Problem types

CWE-190 Integer Overflow or Wraparound

Product status

Default status
unaffected

Any version
affected

Credits

Artem Ivachev from PCA Cyber Security (PCAutomotive) finder

References

i.blackhat.com/...tations/EU-24-Parnishchev-OverTheAirVW.pdf

pcacybersecurity.com/...rabilities-in-vw-mib3-infotainment-2 technical-description

asrg.io/...abilities-in-volkswagen-mib3-infotainment-part-2/ third-party-advisory

cve.org (CVE-2023-28903)

nvd.nist.gov (CVE-2023-28903)

Download JSON