CVE-2024-36600
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via...
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2024-36170
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
EUVD-2024-36170- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-89w5-xc64-fw9r
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via...
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
GHSA-89w5-xc64-fw9r- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
NVD
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-36600
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
ALPINE-CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2024-36600
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
DEBIAN-CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-36600
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
UBUNTU-CVE-2024-36600- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-43630 No score
CVE-2024-36600 affecting package libcdio 2.0.0-8
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
AZL-43630- Updated
- 2026-11-02
OSVAZL-44385 No score
CVE-2024-36600 affecting package libcdio 2.1.0-14
Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image file.
- Record
AZL-44385- Updated
- 2026-11-05
OSVCLSA-2024-1724260558 No score
libcdio: Fix of CVE-2024-36600
- CVE-2024-36600: Allocate more space for buffer, prevent overflow, add input validation
- Record
CLSA-2024-1724260558- Updated
- 2026-11-02
OSVMGASA-2024-0252 No score
Updated libcdio packages fix security vulnerability
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. (CVE-2024-36600)
- Record
MGASA-2024-0252- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12198-1 No score
libcdio++2-2.4.0-1.1 on GA media
These are all security issues fixed in the libcdio++2-2.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12198-1- Updated
- 2026-11-02
OSVUSN-6855-1 No score
libcdio vulnerability
Mansour Gashasbi discovered that libcdio incorrectly handled certain memory operations when parsing an ISO file, leading to a buffer overflow vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code.
- Record
USN-6855-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libcdioAlpine:v3.24 |
2.2.0 up to 2.3.0-r0 | 2.3.0-r0 |
libcdioAzure Linux:2 |
through 2.0.0-8 | None known |
libcdioAzure Linux:3 |
through 2.1.0-14 | None known |
libcdioTuxCare:CentOS:7 |
before 0.92-3.el7.tuxcare.els1 | 0.92-3.el7.tuxcare.els1 |
libcdio-develTuxCare:CentOS:7 |
before 0.92-3.el7.tuxcare.els1 | 0.92-3.el7.tuxcare.els1 |
libcdioDebian:13 |
before 2.2.0-4.1~deb13u1, plus listed versions 2.2.0-4 |
2.2.0-4.1~deb13u1 |
libcdioDebian:14 |
before 2.2.0-4.1, plus listed versions 2.2.0-42.2.0-4.1~deb13u1 |
2.2.0-4.1 |
libcdioMageia:9 |
before 2.1.0-4.1.mga9 | 2.1.0-4.1.mga9 |
libcdioUbuntu:Pro:14.04:LTS |
before 0.83-4.1ubuntu1+esm3, plus listed versions 0.83-4ubuntu10.83-4.10.83-4.1ubuntu10.83-4.1ubuntu1+esm1 |
0.83-4.1ubuntu1+esm3 |
libcdioUbuntu:Pro:16.04:LTS |
before 0.83-4.2ubuntu1+esm3, plus listed versions 0.83-4.20.83-4.2ubuntu10.83-4.2ubuntu1+esm1 |
0.83-4.2ubuntu1+esm3 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libcdioUbuntu:Pro:18.04:LTS |
before 1.0.0-2ubuntu2+esm2, plus listed versions 0.83-4.2ubuntu10.94-0.20.94-11.0.0-21.0.0-2ubuntu11.0.0-2ubuntu2 |
1.0.0-2ubuntu2+esm2 |
libcdioUbuntu:20.04:LTS |
before 2.0.0-2ubuntu0.2, plus listed versions 2.0.0-2 |
2.0.0-2ubuntu0.2 |
libcdioUbuntu:22.04:LTS |
before 2.1.0-3ubuntu0.2, plus listed versions 2.1.0-22.1.0-2build12.1.0-32.1.0-3build1 |
2.1.0-3ubuntu0.2 |
libcdioUbuntu:24.04:LTS |
before 2.1.0-4.1ubuntu1.2, plus listed versions 2.1.0-42.1.0-4.12.1.0-4.1ubuntu1 |
2.1.0-4.1ubuntu1.2 |
libcdioopenSUSE:Tumbleweed |
before 2.4.0-1.1 | 2.4.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-36600 is a high vulnerability (CVSS 8.4) in Gnu Libcdio, published June 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in libcdio 2.3.0-r0.
References
github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600
bugzilla.redhat.com/show_bug.cgi?id=2292833
nvd.nist.gov/vuln/detail/CVE-2024-36600
Show 12 moreShow less
security.alpinelinux.org/vuln/CVE-2024-36600
errata.tuxcare.com/centos7-els/CLSA-2024-1724260558.html
security-tracker.debian.org/tracker/CVE-2024-36600
advisories.mageia.org/MGASA-2024-0252.html
bugs.mageia.org/show_bug.cgi?id=33349
ubuntu.com/security/notices/USN-6855-1
cve.org/CVERecord?id=CVE-2024-36600
lists.gnu.org/archive/html/libcdio-devel/2024-04/msg00000.html
suse.com/security/cve/CVE-2024-36600