Is CVE-2023-41375 actively exploited?

No active exploitation of CVE-2023-41375 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-41375 be exploited remotely?

No. CVE-2023-41375 requires local access to exploit.

What is the CVSS score of CVE-2023-41375?

CVE-2023-41375 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2023-41375

HIGH

CVE-2023-41375

CWE-416Published: September 20, 2023· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. Arbitrary code may be executed by having a user open a specially crafted project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier because the issue exists in parsing of KPP project files. The vendor states that Kostac PLC Programming Software Version 1.6.10.0 or later implements the function which prevents a project file alteration. Therefore, to mitigate the impact of these vulnerabilities, a project file which was saved using Kostac PLC Programming Software Version 1.6.9.0 and earlier needs to be saved again using Kostac PLC Programming Software Version 1.6.10.0 or later.

NVD Source

Technical Analysis

CVE-2023-41375 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-416): Use-after-free vulnerabilities involve accessing memory after it has been freed, often enabling arbitrary code execution.