CVE-2023-34823: 
NixOS vulnerability analysis and mitigation

fdkaac before version 1.0.5 was discovered to contain a stack overflow vulnerability in the read_callback function located in src/main.c. The vulnerability was identified and tracked as CVE-2023-34823. This security issue affects all versions of fdkaac prior to version 1.0.5 (NVD, Debian Tracker).

The vulnerability is classified as a stack-based buffer overflow that occurs in the read_callback function within src/main.c. When tested with Address Sanitizer (ASAN), the vulnerability manifests as a WRITE operation of size 19584 that overflows a stack buffer. The issue occurs in a buffer variable defined at line 57 of the source code (GitHub Issue).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. This indicates that while the vulnerability requires local access and user interaction, it can potentially lead to high impact on system availability (NVD).

The vulnerability has been fixed in fdkaac version 1.0.5. Users are advised to upgrade to this version or later to mitigate the security risk. The fix can be found in the project's repository (GitHub Issue).