CVE-2024-27322

Deserialization of untrusted data can occur in the R statistical programming language, on any...

8.8 HighFix available

Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS (R Data Serialization) formatted file or R package to run arbitrary code on an end user’s system when interacted with.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

23.4%Up 23.4 points since Apr 30, 2024

What each source reports

CVE List Score used 8.8

Record: CVE-2024-27322
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2024-24532 8.8

Record: EUVD-2024-24532
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-82x4-8q4x-2qxv 8.8

Deserialization of untrusted data can occur in the R statistical programming language, on any...

Record: GHSA-82x4-8q4x-2qxv
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

NVD 8.8

Record: CVE-2024-27322
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-27322 8.8

Record: DEBIAN-CVE-2024-27322
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-27322 8.8

Record: UBUNTU-CVE-2024-27322
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-42792 No score

CVE-2024-27322 affecting package R for versions less than 4.4.1-1

Record: AZL-42792
Updated: 2026-11-02

OSVAZL-42815 No score

CVE-2024-27322 affecting package R for versions less than 4.1.0-5

Record: AZL-42815
Updated: 2026-11-02

OSV No score

Record: CVE-2024-27322
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`R` Azure Linux:3	before 4.4.1-1	4.4.1-1
`R` Azure Linux:2	before 4.1.0-5	4.1.0-5
`r-base` Debian:12	All versions, plus listed versions 4.2.2.20221110-24.2.3-14.2.3.20230416-14.3.0-14.3.1-1 Show 44 moreShow less 4.3.1-24.3.1-34.3.1-44.3.2-14.3.3-14.3.3-24.3.3-34.3.3.20240409-14.3.3.20240416-14.4.0-14.4.0-24.4.1-14.4.1-1+hurd.14.4.1-1.14.4.1-24.4.1-34.4.2-14.4.3-14.5.0-14.5.0-24.5.0-34.5.1-14.5.2-14.5.3-14.5.3.20260404-14.5.3.20260410-14.5.3.20260417-14.6.0-14.6.0-24.6.0-34.6.0-44.6.0-54.6.1-14.6.1-104.6.1-114.6.1-24.6.1-34.6.1-44.6.1-54.6.1-64.6.1-74.6.1-84.6.1-94.6.2-1	None known
`r-base` Debian:13	before 4.4.0-2	4.4.0-2
`r-base` Debian:14	before 4.4.0-2	4.4.0-2
`r-base` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 3.0.1-3ubuntu13.0.2-1ubuntu13.0.2-1ubuntu1.1~esm2	None known
`r-base` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 3.2.2-13.2.2.20151203-13.2.3-13.2.3-23.2.3-43.2.3-4ubuntu0.1~esm3	None known
`r-base` Ubuntu:18.04:LTS	All versions, plus listed versions 3.4.2-1ubuntu13.4.2-1ubuntu23.4.2-2ubuntu13.4.3-13.4.3-1build13.4.4-13.4.4-1ubuntu1	None known
`r-base` Ubuntu:20.04:LTS	All versions, plus listed versions 3.6.1-43.6.1-73.6.2-23.6.2.20200221-13.6.2.20200221-1build13.6.3-2	None known
`r-base` Ubuntu:22.04:LTS	All versions, plus listed versions 4.0.4-1build14.1.2-1ubuntu14.1.2-1ubuntu2	None known
`r-base` Ubuntu:24.04:LTS	All versions, plus listed versions 4.3.1-44.3.2-14.3.2-1build14.3.3-2build14.3.3-2build2	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27322 is a high vulnerability (CVSS 8.8) in R-project R, published April 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.4%, the 97th percentile. Fixed in R 4.4.1-1.

References

Show 8 moreShow less