by Kastro
Paper/Archive/CVE-2024-46613

CVE-2024-46613

weechat weechat — WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion ite…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.5.415 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list. This affects string_free_split_shared , string_free_split, string_free_split_command, and string_free_split_tags.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
weechat< 4.4.24.4.2CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP4.3CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refweechat.org/doc/weechat/security/WSA-2024-1refgithub.com/weechat/weechat/issues/2178