CVE-2024-21646
Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
CVE-2024-21646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-19279
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
EUVD-2024-19279- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
CVE-2024-21646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-190
- Updated
- 2026-11-02
OSVAZL-33284
CVE-2024-21646 affecting package azure-iot-sdk-c for versions less than 2022.01.21-2
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
AZL-33284- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-34555
CVE-2024-21646 affecting package azure-iot-sdk-c for versions less than 2024.03.04-1
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
AZL-34555- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
CVE-2024-21646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2024-21646
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
DEBIAN-CVE-2024-21646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21646
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
- Record
UBUNTU-CVE-2024-21646- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13643-1 No score
python310-uamqp-1.6.8-1.1 on GA media
These are all security issues fixed in the python310-uamqp-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13643-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0323-1 No score
Security update for python-uamqp
This update for python-uamqp fixes the following issues:
- CVE-2024-21646: Fix integer overflow which may cause remote code execution (bsc#1219409).
- Record
SUSE-SU-2024:0323-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
azure-iot-sdk-cAzure Linux:2 |
before 2022.01.21-2 | 2022.01.21-2 |
azure-iot-sdk-cAzure Linux:3 |
before 2024.03.04-1 | 2024.03.04-1 |
azure-uamqp-pythonDebian:12 |
All versions, plus listed versions 1.5.3-11.6.10-11.6.11-11.6.11-21.6.4-1 Show 7 moreShow less1.6.5-11.6.5-21.6.8-11.6.8-21.6.9-11.6.9-21.6.9-3 |
None known |
azure-uamqp-pythonDebian:13 |
before 1.6.8-1 | 1.6.8-1 |
azure-uamqp-pythonDebian:14 |
before 1.6.8-1 | 1.6.8-1 |
python-uamqpSUSE:Linux Enterprise Module for Public Cloud 15 SP2 |
before 1.5.3-150100.4.10.1 | 1.5.3-150100.4.10.1 |
python-uamqpSUSE:Linux Enterprise Module for Public Cloud 15 SP3 |
before 1.5.3-150100.4.10.1 | 1.5.3-150100.4.10.1 |
python-uamqpSUSE:Linux Enterprise Module for Public Cloud 15 SP4 |
before 1.5.3-150100.4.10.1 | 1.5.3-150100.4.10.1 |
python-uamqpSUSE:Linux Enterprise Module for Public Cloud 15 SP5 |
before 1.5.3-150100.4.10.1 | 1.5.3-150100.4.10.1 |
python-uamqpopenSUSE:Leap 15.5 |
before 1.5.3-150100.4.10.1 | 1.5.3-150100.4.10.1 |
azure-uamqp-pythonUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.6-11.2.6-21.2.6-4 |
None known |
azure-uamqp-pythonUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.13-11.4.3-11.4.3-1ubuntu11.5.0-11.5.1-11.5.1-1build1 |
None known |
azure-uamqp-pythonUbuntu:24.04:LTS |
All versions, plus listed versions 1.6.5-11.6.5-1build11.6.5-21.6.8-11.6.8-21.6.8-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21646 is a critical vulnerability (CVSS 9.8) in Microsoft Azure Uamqp, published January 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.11%, the 92nd percentile. Fixed in azure-iot-sdk-c 2022.01.21-2.
References
github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpv
nvd.nist.gov/vuln/detail/CVE-2024-21646
security-tracker.debian.org/tracker/CVE-2024-21646
suse.com/support/update/announcement/2024/suse-su-20240323-1