CVE-2026-43233

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the decode choice() function within the nf conntrack h323 helper of the netfilter component. The issue occurs because the boundary check before calling get len() uses an uninitialized len variable set to 0. When a bitstream is fully consumed, the check fails to prevent get len() from reading 1 to 2 bytes past the end of the buffer, leading to a heap-buffer-overflow read. This can be triggered remotely by sending a crafted Q.931 SETUP message containing a User-User Information Element with exactly 2 bytes of PER-encoded data to port 1720 through a firewall where the nf conntrack h323 helper is active.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.