VDB

CVE-2024-24246

CVE-2024-24246 PUBLISHED CVSS 9.300000190734863 CRITICAL

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

EPSS 0.44% · 36.5th percentile

Risk Scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.44%
36.5th percentile

Affected Products

VendorProductVersions
fedoraprojectfedora40, 38, 40
fedoraprojectfedora39, 38, 40
n/an/an/a, *
qpdf_projectqpdf11.9.0, 11.9.0
qpdf_projectqpdf11.9.0, 11.9.0

Timeline

  • Feb 29, 2024 CVE Published
  • Feb 29, 2024 PoC Published
  • Mar 1, 2024 EPSS Score
  • Mar 1, 2024 PoC Published
  • Mar 28, 2024 EPSS Score
  • Apr 23, 2024 EPSS Score
  • May 20, 2024 EPSS Score
  • Jun 16, 2024 EPSS Score
  • Jul 12, 2024 EPSS Score
  • Aug 8, 2024 EPSS Score
  • Sep 4, 2024 EPSS Score
  • Oct 1, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›