CVE-2024-2961CWE-787

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the…

High · published April 17, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.3. It sits in the 99.8th percentile for exploit probability.

CVSS v3.1
7.3
EPSS
88%
Percentile
99.8
In the wild
Unconfirmed
What it is

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.88330 · 99.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2024-04-17T17:27Z
EPSS history
Timeline
  • 17 APR 17:27Z
    The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the…
    cvelistv5