CVE-2024-37535
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via...
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
CVE-2024-37535- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2024-36736
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
EUVD-2024-36736- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wrc7-97qh-j6mh
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via...
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
GHSA-wrc7-97qh-j6mh- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
CVE-2024-37535- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
CVE-2024-37535- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-37535
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
DEBIAN-CVE-2024-37535- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVOESA-2024-1803
vte291 security update
VTE provides a virtual terminal widget for GTK applications.VTE is mainly used in gnome-terminal, but can also be used to embed a console/terminal in games, editors, IDEs, etc.
Security Fix(es):
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.(CVE-2024-37535)
- Record
OESA-2024-1803- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-1826
vte291 security update
VTE provides a virtual terminal widget for GTK applications.VTE is mainly used in gnome-terminal, but can also be used to embed a console/terminal in games, editors, IDEs, etc.
Security Fix(es):
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.(CVE-2024-37535)
- Record
OESA-2024-1826- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-1827
vte291 security update
VTE provides a virtual terminal widget for GTK applications.VTE is mainly used in gnome-terminal, but can also be used to embed a console/terminal in games, editors, IDEs, etc.
Security Fix(es):
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.(CVE-2024-37535)
- Record
OESA-2024-1827- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-1828
vte291 security update
VTE provides a virtual terminal widget for GTK applications.VTE is mainly used in gnome-terminal, but can also be used to embed a console/terminal in games, editors, IDEs, etc.
Security Fix(es):
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.(CVE-2024-37535)
- Record
OESA-2024-1828- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2024-1829
vte291 security update
VTE provides a virtual terminal widget for GTK applications.VTE is mainly used in gnome-terminal, but can also be used to embed a console/terminal in games, editors, IDEs, etc.
Security Fix(es):
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.(CVE-2024-37535)
- Record
OESA-2024-1829- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-37535
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
UBUNTU-CVE-2024-37535- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-42631 No score
CVE-2024-37535 affecting package vte291 for versions less than 0.66.2-3
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
AZL-42631- Updated
- 2026-11-02
OSVAZL-43167 No score
CVE-2024-37535 affecting package vte291 for versions less than 0.74.2-6
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.
- Record
AZL-43167- Updated
- 2026-11-05
OSVMGASA-2024-0219 No score
Updated vte packages fix security vulnerability
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476. (CVE-2024-37535)
- Record
MGASA-2024-0219- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14284-1 No score
libvte-2_91-0-0.76.3-3.1 on GA media
These are all security issues fixed in the libvte-2_91-0-0.76.3-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14284-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2151-1 No score
Security update for vte
This update for vte fixes the following issues:
- CVE-2024-37535: Fixed a bug that allowed an attacker to cause a denial of service (memory consumption) via a window resize escape. (bsc#1226134)
- Record
SUSE-SU-2024:2151-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2152-1 No score
Security update for vte
This update for vte fixes the following issues:
- CVE-2024-37535: Fixed a bug that allowed an attacker to cause a denial of service (memory consumption) via a window resize escape. (bsc#1226134)
- Record
SUSE-SU-2024:2152-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2153-1 No score
Security update for vte
This update for vte fixes the following issues:
- CVE-2024-37535: Fixed a bug that allowed an attacker to cause a denial of service (memory consumption) via a window resize escape. (bsc#1226134)
- Record
SUSE-SU-2024:2153-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2180-1 No score
Security update for vte
This update for vte fixes the following issues:
- CVE-2024-37535: Fixed a bug that allowed an attacker to cause a denial of service (memory consumption) via a window resize escape. (bsc#1226134)
- Record
SUSE-SU-2024:2180-1- Updated
- 2026-11-02
OSVUSN-6833-1 No score
vte2.91 vulnerability
Siddharth Dushantha discovered that VTE incorrectly handled large window resize escape sequences. An attacker could possibly use this issue to consume resources, leading to a denial of service.
- Record
USN-6833-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vte291Azure Linux:2 |
before 0.66.2-3 | 0.66.2-3 |
vte291Azure Linux:3 |
before 0.74.2-6 | 0.74.2-6 |
vteDebian:12 |
All versions, plus listed versions 1:0.28.2-61:0.28.2-6.11:0.28.2-6.1~exp11:0.28.2-6.1~exp21:0.28.2-7 |
None known |
vteDebian:13 |
All versions, plus listed versions 1:0.28.2-7 |
None known |
vteDebian:14 |
All versions, plus listed versions 1:0.28.2-7 |
None known |
vte2.91Debian:12 |
All versions, plus listed versions 0.70.3-10.70.5-10.70.5-20.70.6-10.70.6-1~deb12u1 Show 45 moreShow less0.70.6-20.70.6-2~deb12u10.71.92-10.71.99-10.72.0-10.72.1-10.72.2-10.72.2-20.72.2-30.73.93-10.73.99-10.74.0-10.74.0-20.74.1-10.74.2-10.75.0-10.75.91-10.75.91-20.75.92-10.76.0-10.76.1-10.76.2-10.76.3-10.76.3-20.76.3-40.76.3-60.77.91-10.77.91-20.77.92-10.78.0-10.78.1-10.78.2-10.78.3-10.78.3-20.78.3-30.79.90-10.79.90-20.79.91-10.79.91-20.80.0-10.80.1-10.80.3-10.80.3-20.80.3-30.82.0-1 |
None known |
vte2.91Debian:13 |
before 0.76.3-6 | 0.76.3-6 |
vte2.91Debian:14 |
before 0.76.3-6 | 0.76.3-6 |
vteMageia:9 |
before 0.72.1-1.1.mga9 | 0.72.1-1.1.mga9 |
vte291openEuler:24.03-LTS |
before 0.72.2-2.oe2403 | 0.72.2-2.oe2403 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
vte291openEuler:22.03-LTS-SP3 |
before 0.62.3-2.oe2203sp3 | 0.62.3-2.oe2203sp3 |
vte291openEuler:20.03-LTS-SP4 |
before 0.54.1-6.oe2003sp4 | 0.54.1-6.oe2003sp4 |
vte291openEuler:22.03-LTS-SP4 |
before 0.62.3-2.oe2203sp4 | 0.62.3-2.oe2203sp4 |
vte291openEuler:22.03-LTS-SP1 |
before 0.62.3-2.oe2203sp1 | 0.62.3-2.oe2203sp1 |
vteSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.44.2-9.6.1 | 0.44.2-9.6.1 |
vteSUSE:Linux Enterprise Server 12 SP5 |
before 0.44.2-9.6.1 | 0.44.2-9.6.1 |
vteSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 0.44.2-9.6.1 | 0.44.2-9.6.1 |
vteSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Enterprise Storage 7.1 |
before 0.58.3-150200.3.3.1 | 0.58.3-150200.3.3.1 |
vteSUSE:Linux Enterprise Module for Basesystem 15 SP6 |
before 0.74.2-150600.3.3.1 | 0.74.2-150600.3.3.1 |
vteSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 |
before 0.74.2-150600.3.3.1 | 0.74.2-150600.3.3.1 |
vteopenSUSE:Leap 15.6 |
before 0.74.2-150600.3.3.1 | 0.74.2-150600.3.3.1 |
vteSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Manager Proxy 4.3 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteSUSE:Manager Server 4.3 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vteopenSUSE:Leap 15.5 |
before 0.66.2-150400.3.5.1 | 0.66.2-150400.3.5.1 |
vte2.91Ubuntu:16.04:LTS |
All versions, plus listed versions 0.40.2-1ubuntu30.42.1-1ubuntu10.42.1-1ubuntu20.42.1-2ubuntu10.42.4-1ubuntu10.42.4-1ubuntu20.42.5-1ubuntu1 |
None known |
vte2.91Ubuntu:18.04:LTS |
All versions, plus listed versions 0.48.4-0ubuntu10.50.2-4ubuntu20.51.90-1ubuntu10.51.92-1ubuntu10.52.0-1ubuntu1 Show 4 moreShow less0.52.0-1ubuntu20.52.1-1ubuntu10.52.2-1ubuntu1~18.04.10.52.2-1ubuntu1~18.04.2 |
None known |
vte2.91Ubuntu:20.04:LTS |
before 0.60.3-0ubuntu1~20.5, plus listed versions 0.58.2-1ubuntu20.59.91-0ubuntu10.59.91-0ubuntu20.60.0-2ubuntu20.60.1-1ubuntu10.60.3-0ubuntu1~20.04 |
0.60.3-0ubuntu1~20.5 |
vte2.91Ubuntu:22.04:LTS |
before 0.68.0-1ubuntu0.1, plus listed versions 0.64.2-1ubuntu10.64.2-30.66.1-10.66.2-10.66.2-1build10.67.90-20.68.0-1 |
0.68.0-1ubuntu0.1 |
vte2.91Ubuntu:24.04:LTS |
before 0.76.0-1ubuntu0.1, plus listed versions 0.74.0-20.74.1-10.74.1-1build10.74.2-10.75.91-20.75.92-1build10.75.92-1build20.76.0-1 |
0.76.0-1ubuntu0.1 |
vteopenSUSE:Tumbleweed |
before 0.76.3-3.1 | 0.76.3-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37535 is a medium vulnerability (CVSS 4.4) in vte, published June 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. Fixed in vte291 0.66.2-3.
References
gitlab.gnome.org/GNOME/vte/-/issues/2786
openwall.com/lists/oss-security/2024/06/09/1
nvd.nist.gov/vuln/detail/CVE-2024-37535
github.com/advisories/GHSA-wrc7-97qh-j6mh
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2024-37535
advisories.mageia.org/MGASA-2024-0219.html
bugs.mageia.org/show_bug.cgi?id=33277
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1803
suse.com/support/update/announcement/2024/suse-su-20242151-1
bugzilla.suse.com/1226134
ubuntu.com/security/CVE-2024-37535
cve.org/CVERecord?id=CVE-2024-37535
Left out here: 8 versions. The JSON record has them.