CVE-2014-9765

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9...

8.8 HighFix available

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.16%Down 3.7 points since Feb 4, 2022

What each source reports

NVD Score used 8.8

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: CVE-2014-9765
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: CVE-2014-9765
Updated: 2026-11-02

EUVDEUVD-2014-9571 No score

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: EUVD-2014-9571
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g659-9pjq-jf3x 8.8

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9...

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: GHSA-g659-9pjq-jf3x
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 8.8

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: CVE-2014-9765
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-9765 8.8

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: DEBIAN-CVE-2014-9765
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-9765 8.8

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.

Record: UBUNTU-CVE-2014-9765
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0084 No score

Updated xdelta3 packages fix CVE-2014-9765

Updated xdelta3 package fixes security vulnerability:

Stepan Golosunov discovered that xdelta3, a diff utility which works with binary files, is affected by a buffer overflow vulnerability within the main_get_appheader function, which may lead to the execution of arbitrary code (CVE-2014-9765).

Record: MGASA-2016-0084
Updated: 2026-11-02

OSVUSN-2901-1 No score

xdelta3 vulnerability

It was discovered that xdelta3 incorrectly handled certain files. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could use this issue to cause xdelta3 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record: USN-2901-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`xdelta3` Debian:12	before 3.0.8-dfsg-1.1	3.0.8-dfsg-1.1
`xdelta3` Debian:13	before 3.0.8-dfsg-1.1	3.0.8-dfsg-1.1
`xdelta3` Debian:14	before 3.0.8-dfsg-1.1	3.0.8-dfsg-1.1
`xdelta3` Debian:6.0	before 0y.dfsg-1+deb6u1, plus listed versions 0y.dfsg-1	0y.dfsg-1+deb6u1
`xdelta3` Debian:7	before 3.0.0.dfsg-1+deb7u1, plus listed versions 3.0.0.dfsg-1	3.0.0.dfsg-1+deb7u1
`xdelta3` Debian:8	before 3.0.8-dfsg-1+deb8u1, plus listed versions 3.0.8-dfsg-1	3.0.8-dfsg-1+deb8u1
`xdelta3` Mageia:5	before 3.0.0-5.1.mga5	3.0.0-5.1.mga5
`xdelta3` Ubuntu:14.04:LTS	before 3.0.7-dfsg-2ubuntu0.2, plus listed versions 3.0.7-dfsg-2	3.0.7-dfsg-2ubuntu0.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9765 is a high vulnerability (CVSS 8.8) in Xdelta Xdelta3, published December 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.16%, the 90th percentile. Fixed in xdelta3 3.0.8-dfsg-1.1.

References

Show 11 moreShow less