CVE-2024-3209: A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function get_ne64 of the file bele.h. The manipulation…

PriorityP262critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.22%

65.0th percentile

A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function get_ne64 of the file bele.h. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259055. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	upx-ucl	< upx-ucl 4.2.4-1 (forky)	upx-ucl 4.2.4-1 (forky)
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
upx	upx	<= 4.2.2	—
upx	upx	—	—
upx	upx	—	—
upx	upx	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is triggered via the get_ne64 function in bele.h, indicating heap-based buffer overflow when processing a maliciously crafted input file with UPX up to 4.2.2 ↗

·Scope is local; exploitation requires local access or supplying a crafted file to UPX for processing ↗
·Affected versions are UPX up to and including 4.2.2; Debian fixed the issue in version 4.2.4-1 for forky, sid, and trixie, but bullseye remains open/unpatched ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.05.2MEDIUMAV:A/AC:L/Au:S/C:P/I:P/A:P

osv9.8CRITICAL

vendor_debian5.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.