CVE-2024-13941CWE-119

ouch-org ouch zip.rs convert_zip_date_time memory corruption

Medium · published April 1, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convert_zip_date_time of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.4.0 is able to address this issue. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2025-04-01T21:00Z
EPSS history
Timeline
  • 01 APR 21:00Z
    ouch-org ouch zip.rs convert_zip_date_time memory corruption
    cvelistv5