PoC Index

CVE-2024-37407

CRITICAL 9.1EPSS 1.0%

Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.

CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS
0.97% chance of exploitation in the next 30 days, 60th percentile
Published
2024-06-08
Updated
2025-03-14

Proof-of-concept exploits (1)

References

Related