CVE-2023-34366

A use-after-free vulnerability exists in the Figure stream parsing functionality of Ichitaro 2023 1.0.1.59372. A specially crafted document can cause memory corruption, resulting in arbitrary code execution. Victim would need to open a malicious file to trigger this vulnerability.

Score

CVSS 3.1 7.8 High

Status

Modified - talos-cna@cisco.com

Published

2023-10-19

Last modified

2025-11-04

Weaknesses

CWE-416

Affected products

• Ichitaro 2023 (Ichitaro 2023)
• Easy Postcard Max (Justsystems)
• Ichitaro 2021 (Justsystems)
• Ichitaro 2022 (Justsystems)
• Ichitaro 2023 (Justsystems)
• Ichitaro Government 10 (Justsystems)
• Ichitaro Government 8 (Justsystems)
• Ichitaro Government 9 (Justsystems)
• Ichitaro Pro 3 (Justsystems)
• Ichitaro Pro 4 (Justsystems)
• Ichitaro Pro 5 (Justsystems)
• Just Government 3 (Justsystems)
• Just Government 4 (Justsystems)
• Just Government 5 (Justsystems)
• Just Office 3 (Justsystems)
• Just Office 4 (Justsystems)
• Just Office 5 (Justsystems)
• Just Police 3 (Justsystems)
• Just Police 4 (Justsystems)
• Just Police 5 (Justsystems)

References

• https://jvn.jp/en/jp/JVN28846531/index.html
• https://talosintelligence.com/vulnerability_reports/TALOS-2023-1758
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1758