CVE-2024-2961
HIGH 7.3EPSS 88.3%
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
- Affected
- The GNU C Library · glibc
- CVSS v3.1 CNA
- 7.3 HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - EPSS
- 88.33% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- high · CWE-787
- Published
- 2024-04-17
- Updated
- 2026-10-15
Proof-of-concept exploits (16)
- 4wayhandshake/CVE-2024-29610★ · 2025-02-01
- ambionics/cnext-exploits505★ · 2024-09-30
- exfil0/test_iconv0★ · 2024-06-04
- jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento9★ · 2024-07-05
- kjdfklha/CVE-2024-2961_poc2★ · 2024-06-04
- kyotozx/CVE-2024-2961-Remote-File-Read5★ · 2025-05-07
- mesudmammad1/CVE-2023-26326_Buddyform_exploit0★ · 2025-02-12
- omarelshopky/exploit_cve-2023-26326_using_cve-2024-29611★ · 2025-02-02
- rvizx/CVE-2024-29615★ · 2024-05-20
- suce0155/CVE-2024-2961_buddyforms_2.7.74★ · 2025-02-04
- tnishiox/cve-2024-29610★ · 2024-06-04
- Clarissss/osTicketFileReadIntoRCE0★ · 2026-03-03
- suce0155/CVE-2024-29614★ · 2025-02-04
- horizon3ai/CVE-2026-2220015★ · 2026-01-22
- qinglove777/CVE-2024-2961-XXE-Exploit0★ · 2026-09-09
- Sib1110/cve-2024-2961
Nuclei templates (1)
Metasploit modules (1)
Vulhub environments (1)
Security advisories
- http://www.openwall.com/lists/oss-security/2024/04/17/9
- http://www.openwall.com/lists/oss-security/2024/04/18/4
- http://www.openwall.com/lists/oss-security/2024/04/24/2
- http://www.openwall.com/lists/oss-security/2024/05/27/1
- http://www.openwall.com/lists/oss-security/2024/05/27/2
- http://www.openwall.com/lists/oss-security/2024/05/27/3
- http://www.openwall.com/lists/oss-security/2024/05/27/4
- http://www.openwall.com/lists/oss-security/2024/05/27/5
- http://www.openwall.com/lists/oss-security/2024/05/27/6
- http://www.openwall.com/lists/oss-security/2024/07/22/5
- https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html
- https://security.netapp.com/advisory/ntap-20240531-0002
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004