The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
CVE-2024-2961
CVSS base score
7.3 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-787
Last modified
November 4, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected products
gnu glibc
netapp active iq unified manager
debian debian linux
netapp hci h300s firmware
netapp hci h500s firmware
netapp hci h700s firmware
netapp hci h410s firmware
netapp hci h410c firmware
netapp hci h610c firmware
netapp hci h610s firmware
References
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory
- www.openwall.com Mailing List, Third Party Advisory