CVE-2024-31636

LIEF obtain sensitive information via the name parameter

3.9 LowFix available

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.24%Up 0.2 points since May 4, 2024

What each source reports

CVE List Score used 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: CVE-2024-31636
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-457
Updated: 2026-11-02

EUVDEUVD-2024-1873 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: EUVD-2024-1873
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-377p-g8gr-5wpg 3.9

LIEF obtain sensitive information via the name parameter

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: GHSA-377p-g8gr-5wpg
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-457
Updated: 2026-11-02

NVD 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: CVE-2024-31636
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-457
Updated: 2026-11-02

OSV 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: CVE-2024-31636
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-31636 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: DEBIAN-CVE-2024-31636
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-377p-g8gr-5wpg 3.9

LIEF obtain sensitive information via the name parameter

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: GHSA-377p-g8gr-5wpg
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness: CWE-457
Updated: 2026-11-02

OSVPYSEC-2024-280 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: PYSEC-2024-280
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-31636 3.9

An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.

Record: UBUNTU-CVE-2024-31636
CVSS 3.1: 3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

lief-project lief

Affected packages

Affected packages
Package	Affected	Fixed
`lief` PyPI	before 0.15.0	0.15.0
`lief` Debian:12	All versions, plus listed versions 0.9.0-1	None known
`lief` PyPI	before 0.15.0, plus listed versions 0.10.00.10.10.11.00.11.10.11.2 Show 17 moreShow less 0.11.30.11.40.11.50.12.00.12.10.12.20.12.30.13.00.13.10.13.20.14.00.14.10.8.00.8.10.8.20.8.30.9.0	0.15.0
`lief` PyPI	through 0.14.1, plus listed versions 0.10.00.10.10.11.00.11.10.11.2 Show 16 moreShow less 0.11.30.11.40.11.50.12.00.12.10.12.20.12.30.13.00.13.10.13.20.14.00.8.00.8.10.8.20.8.30.9.0	None known
`lief` Ubuntu:20.04:LTS	All versions, plus listed versions 0.9.0-1build10.9.0-1build2	None known
`lief` Ubuntu:22.04:LTS	All versions, plus listed versions 0.9.0-1build20.9.0-1build3	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-31636 is a low vulnerability (CVSS 3.9) in Lief-project Lief, published May 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in lief 0.15.0.

References

Show 5 moreShow less