CVE-2023-47430 is a stack buffer overflow in ReadyMedia (MiniDLNA) 1.3.3, in the SendContainer function of tivo_commands.c. NVD scores it 7.5, High, for denial of service. I could not confirm a fixed release, so turn off TiVo support if you do not need it and watch the project for a patch.
What's affected
The record names ReadyMedia 1.3.3 from the ReadyMedia project. The function is SendContainer in tivo_commands.c. The weaknesses listed are CWE-787, out-of-bounds write, and CWE-120, buffer copy without checking input size.
The project bug report, number 361 on SourceForge, says the overflows come from unbounded string concatenation on several variables in that function. It describes the test build as one compiled with TiVo support turned on and the enable_tivo option set to yes. That suggests the vulnerable path is reachable only when TiVo support is built in and enabled. I read this from the bug report and did not test it.
No fixed release is named. A community member attached a patch to the bug report in July 2025, and the thread notes the CVE was assigned in March 2024. A patch in a bug tracker is not a release, so check the project's download page for the current version.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Impact is availability only.
How to check if you're exposed
Print the installed version, and check whether TiVo support is turned on in the configuration file:
minidlnad -V
grep -n enable_tivo /etc/minidlna.conf
The configuration path varies by distribution. If the option is set to no or the line is missing, the path described in the bug report is not enabled in your configuration. If your build was compiled without TiVo support at all, it is not in play either. Distribution packages differ, so check your package's build notes.
If you run MiniDLNA inside a container image, check the image's installed package version in the same way, or scan the image for the package.
What to do now
- Keep enable_tivo set to no unless you have a TiVo device that needs it.
- Check your distribution's package tracker for a patched build of ReadyMedia, and install it when one appears.
- Restrict the server to your local network. A media server rarely needs to be reachable from the internet.
- Put the daemon under a supervisor that restarts it, so a crash does not mean a long outage.
- Track the project's bug report for the upstream fix, and review it before applying any unofficial patch.
Why it matters
A stack buffer overflow happens when code copies more data into a fixed-size area on the stack than the area can hold. The extra data overwrites neighbouring memory. In the best case the program crashes. In the worst case an attacker steers what runs next. The record claims only denial of service, and that is what this post claims.
The cause here, per the bug report, is repeated string concatenation without a length check. This is the textbook case for CWE-120, and it is why C code that builds strings from request fields needs bounded functions and explicit size checks.
Home media servers are a good example of software that people install once and forget. They may sit on a network for years with an unpatched version. A denial of service in a media server is low stakes on its own. The wider point is that a small daemon on a flat network is still a listening service, and the version should be on your list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is MiniDLNA affected if TiVo support is off?
Per the bug report, the reproduction used a build with TiVo support enabled. If your build or configuration does not enable it, the described path is not in use. Confirm against your package.
Is there an official fix?
I could not confirm a release. A patch was posted on the bug report, and the project's download page is the place to check.
Sources
Last reviewed: 19 October 2026.
