CVE-2024-24246

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via...

5.5 MediumFix available

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.44%Up 0.4 points since Mar 1, 2024

What each source reports

NVD Score used 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-787, CWE-122
Updated: 2026-11-02

CVE List 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-122
Updated: 2026-11-02

EUVDEUVD-2024-21670 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: EUVD-2024-21670
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6733-f273-8q48 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via...

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: GHSA-6733-f273-8q48
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-122, CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2024-24246 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: ALPINE-CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-24246 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: DEBIAN-CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-24246 5.5

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Record: UBUNTU-CVE-2024-24246
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2024-0076 No score

Updated qpdf packages fix security vulnerability

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h. (CVE-2024-24246)

Record: MGASA-2024-0076
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`qpdf` Alpine:v3.20	before 11.9.1-r0	11.9.1-r0
`qpdf` Alpine:v3.21	before 11.9.1-r0	11.9.1-r0
`qpdf` Alpine:v3.22	before 11.9.1-r0	11.9.1-r0
`qpdf` Alpine:v3.23	before 11.9.1-r0	11.9.1-r0
`qpdf` Alpine:v3.24	before 11.9.1-r0	11.9.1-r0
`qpdf` Debian:12	All versions, plus listed versions 11.10.0-111.10.1-111.3.0-111.3.0-1+deb12u111.4.0-1 Show 28 moreShow less 11.5.0-111.6.0-111.6.1-111.6.2-111.6.2-211.6.3-111.6.4-111.7.0-111.7.0-211.7.0-311.7.0-411.8.0-111.8.0-1.1~exp111.9.0-111.9.0-1.111.9.0-211.9.0-2~exp111.9.1-112.0.0-112.0.0-212.1.0-112.2.0-112.3.0-112.3.1-112.3.2-112.4.0-112.4.1-112.4.2-1	None known
`qpdf` Debian:13	before 11.9.0-1	11.9.0-1
`qpdf` Debian:14	before 11.9.0-1	11.9.0-1
`qpdf` Mageia:9	before 11.9.0-1.mga9	11.9.0-1.mga9

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-24246 is a medium vulnerability (CVSS 5.5) in Qpdf Project Qpdf, published February 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in qpdf 11.9.1-r0.

References

Show 11 moreShow less