CVE-2008-4865
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute...
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
Exploit likelihood
What each source reports
NVD Score used
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
CVE-2008-4865- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
CVE-2008-4865- Updated
- 2026-11-02
EUVDEUVD-2008-4844 No score
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
EUVD-2008-4844- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gjj4-r6j8-99mm No score
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute...
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
GHSA-gjj4-r6j8-99mm- Updated
- 2026-11-02
OSV No score
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
CVE-2008-4865- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-4865 No score
Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.
- Record
DEBIAN-CVE-2008-4865- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11492-1 No score
valgrind-3.17.0-2.3 on GA media
These are all security issues fixed in the valgrind-3.17.0-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11492-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
valgrindDebian:12 |
before 1:3.3.1-3 | 1:3.3.1-3 |
valgrindDebian:13 |
before 1:3.3.1-3 | 1:3.3.1-3 |
valgrindDebian:14 |
before 1:3.3.1-3 | 1:3.3.1-3 |
valgrindRed Hat:enterprise_linux:5::client_workstation |
before 1:3.5.0-1.el5 | 1:3.5.0-1.el5 |
valgrind-develRed Hat:enterprise_linux:5::client_workstation |
before 1:3.5.0-1.el5 | 1:3.5.0-1.el5 |
valgrindRed Hat:enterprise_linux:5::server |
before 1:3.5.0-1.el5 | 1:3.5.0-1.el5 |
valgrind-develRed Hat:enterprise_linux:5::server |
before 1:3.5.0-1.el5 | 1:3.5.0-1.el5 |
valgrindopenSUSE:Tumbleweed |
before 3.17.0-2.3 | 3.17.0-2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-4865 is a high vulnerability (CVSS 7.2) in Valgrind, published October 31, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in valgrind 1:3.3.1-3.
References
sourceforge.net/mailarchive/forum.php?thread_name=200901032045.17604.jseward%40acm.org&forum_name=valgrind-announce
openwall.com/lists/oss-security/2008/10/28/5
lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
secunia.com/advisories/33568
Show 13 moreShow less
security.gentoo.org/glsa/glsa-200902-03.xml
nvd.nist.gov/vuln/detail/CVE-2008-4865
github.com/advisories/GHSA-gjj4-r6j8-99mm
security-tracker.debian.org/tracker/CVE-2008-4865
access.redhat.com/errata/RHEA-2010:0272
bugzilla.redhat.com/show_bug.cgi?id=515768
security.access.redhat.com/data/csaf/v2/advisories/2010/rhea-2010_0272.json
cve.org/CVERecord?id=CVE-2008-4865
suse.com/security/cve/CVE-2008-4865