CVE-2023-44452 is a high severity argument injection flaw in how Linux Mint Xreader opens CBT comic archives, scored 7.8. Upstream removed the external commands and now unpacks archives with libarchive. The sources name no release number, so update Xreader and check the changelog.
What's affected
The NVD record lists Linux Mint Xreader 3.8.2 as affected. The ZDI advisory ZDI-23-1836 (ZDI-CAN-22132), dated 20 December 2023, says Linux Mint has issued an update and links the upstream commit "comics: Use libarchive to unpack documents". Neither source names a release number.
NVD and ZDI both score the flaw 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the sources agree. The record text says remote attackers, but the vector is local and needs the user to open a file.
The upstream commit message says it eliminates the use of external commands for opening comic documents and relies on libarchive instead. It notes the change is based on an earlier fix in the GNOME Evince project. The flaw was in handling of CBT files, a comic book archive format.
The sibling record CVE-2023-44451 covers a path traversal bug in EPUB handling in the same program. Check that your update covers both.
Weakness class: CWE-88 (argument injection).
How to check if you're exposed
Read the installed version:
xreader --version
On Debian based systems, apt policy xreader shows the installed and available versions. Version 3.8.2 is the one named in the record. After updating, confirm in the project history that the comics backend change (use libarchive to unpack documents) is included in the release you installed.
What to do now
- Inventory the machines that run Xreader, mainly Linux Mint desktops.
- Update Xreader through your package manager and restart any open instances.
- Check the project changelog for the release that contains the libarchive change, and note it in your records.
- Until updated, do not open comic archives (CBT, CBZ and similar) from unknown sources in Xreader.
- Review any other tool in your workflow that shells out to archive utilities when opening files.
Why it matters
Argument injection, tracked as CWE-88, happens when a program builds a command line from untrusted data and the data can add or change options for the command it runs. The advisory says the string from the file was not validated before it was used in a system call. The upstream remedy is telling: it removes external commands from this code path altogether instead of trying to filter them.
That design choice is worth copying. Escaping input for a shell is easy to get wrong, while calling a library directly leaves no command line to inject into. CVE-2023-44452 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
For your own code, a search for process spawning calls that include file names or archive entry names is a good first check. Safeguard's free in-browser dependency scan helps with the library side of that picture.
Quick check
What did upstream change to fix CVE-2023-44452?
The commit stops using external commands for comic documents and unpacks archives with libarchive instead.
Do NVD and ZDI agree on severity?
Yes, both give 7.8 with the same vector.
Sources
Last reviewed: 19 October 2026.
