WaratekVRT Sign in

CVE-2024-2961

Affected software4 products, listed below
Severity7.3 High CVSS 3.1
WeaknessOut-of-bounds write (CWE-787)
Published17 Apr 2024
Updated4 Nov 2026

Description

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · 12 exploits · earliest 2024-09-16.
  • CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: partial.
  • Indexed PoC 17 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2024-04-24.
  • EPSS 88% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2024-2961 in VulnCheck (free account), which lists 7 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation sansec.io /research/cosmicsting 2024-09-16
Reported exploitation trustwave.com /en-us/resources/blogs/spiderlabs-blog/the-state-of-magecart-a-persistent-threat-to-e-commerce-security 2025-01-09
Exploit reference VulnCheck XDB cab9ee9dc6bb Exploit type: initial-access 2024-05-27
Exploit reference VulnCheck XDB cb29502a8900 Exploit type: local 2024-06-03
Exploit reference VulnCheck XDB 4bd6d8711dbe Exploit type: local 2024-06-04
Exploit reference VulnCheck XDB 29c7d412dfde Exploit type: infoleak 2025-01-27
Exploit reference VulnCheck XDB 75be8eeb8fa5 Exploit type: initial-access 2025-02-02

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() 505 2024-05-27
Nuclei PHP - LFR to Remote Code Execution
Metasploit CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) (excellent rank)
GitHub PoC This script demonstrates a proof-of-concept (PoC) for exploiting a file read vulnerability in the iconv library, as detailed in Ambionics Security's blog https://www.ambionics.io/blog/iconv-cve-2024-2961-p1. 5 2025-01-27
GitHub PoC CVE-2024–2961 Security Issue Mitigation Script 5 2024-05-20
GitHub PoC CVE-2024-2961 Cnext RCE Exploit with Buddyforms 2.7.7 4 2025-02-04
GitHub PoC kjdfklha/CVE-2024-2961_poc 2 2024-06-04
GitHub PoC Quick mitigation script 2 2024-04-24
GitHub PoC Exploit for CVE-2023-26326 in the WordPress BuddyForms plugin, leveraging CVE-2024-2961 for remote code execution. This exploit bypasses PHP 8+ deserialization limitations by chaining vulnerabilities with php://filter. 1 2025-02-02
GitHub PoC CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel 2026-09-09

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2025 ↗ CPU 2025-Q1 Oracle Communications / Automated Test Suite (glibc) (9.0.0.0.0-9.0.2.0.0)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Communications / Alarms, KPI, and Measurements (glibc) (23.4.0-23.4.6)
Oracle Communications / Configuration (glibc) (23.4.0, 24.1.0, 24.2.0)
Oracle Communications / Management Service (glibc) (23.4.0-23.4.5)
Oracle Communications / Mediation Engine (glibc) (5.1, 5.2)
Oracle Communications / Platform (glibc) (9.1.1.8.0)
Oracle Communications / Routing (glibc) (9.1.0, 9.2.0, 9.3.0)
Oracle Communications / Routing (glibc) (9.1.5)
Oracle Communications / System (glibc) (4.1.0, 4.2.0)
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Communications / Signaling (glibc) (23.4.1)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Alarms, KPI, and Measurements (glibc) 23.4.0-23.4.6
Oracle Communications Automated Test Suite (glibc) 9.0.0.0.0-9.0.2.0.0
Oracle Communications Configuration (glibc) 23.4.0, 24.1.0, 24.2.0 23.4.0 · 24.1.0 · 24.2.0
Oracle Communications Management Service (glibc) 23.4.0-23.4.5
Oracle Communications Mediation Engine (glibc) 5.1, 5.2 5.1 · 5.2
Oracle Communications Platform (glibc) 9.1.1.8.0 9.1.1.8.0
Oracle Communications Routing (glibc) 9.1.0, 9.2.0, 9.3.0 9.1.0 · 9.1.5 · 9.2.0 · 9.3.0
Oracle Communications Signaling (glibc) 23.4.1 23.4.1
Oracle Communications System (glibc) 4.1.0, 4.2.0 4.1.0 · 4.2.0

Products and versions

13 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 10.0
nvd gnu glibc generic ≥ 2.1.93 and ＜ 2.40
nvd netapp active iq unified manager generic any version
nvd netapp hci compute node generic any version
nvd netapp hci h300s firmware generic any version
nvd netapp hci h410c firmware generic any version
nvd netapp hci h410s firmware generic any version
nvd netapp hci h500s firmware generic any version
nvd netapp hci h610c firmware generic any version
nvd netapp hci h610s firmware generic any version
nvd netapp hci h615c firmware generic any version
nvd netapp hci h700s firmware generic any version
nvd netapp ontap select deploy administration utility generic any version

References

URLTags
http://www.openwall.com/lists/oss-security/2024/04/17/9 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/18/4 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/24/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/1 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/2 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/3 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/4 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/5 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/6 Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List, Third Party Advisory

Timeline
Published2024-04-17By the CVE Program.
VulnCheck KEV: earliest evidence2024-09-16Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2026-10-16Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-11-04NVD's own last-modified date for this record.