CVE-2023-28902
Denial of Service via integer underflow in picserver
- State
- Published
- Severity
- 3.3 Low
- Published
- Jun 28, 2025
- Updated
- Jun 30, 2025
- Reserved
- Mar 27, 2023
Description
An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | ASRG |
Weaknesses
- CWE-191 Integer Underflow (Wrap or Wraparound)
Affected Products
| Product | Versions |
|---|---|
Volkswagen MIB3 infotainment system MIB3 OI MQBPreh Car Connect GmbH (JOYNEXT GmbH) |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.