CVE-2024-43700
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data,...
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
CVE-2024-43700- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787, CWE-120
- Updated
- 2026-11-02
CVE List
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
CVE-2024-43700- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-40434
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
EUVD-2024-40434- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-436p-pp82-ppwq
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data,...
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
GHSA-436p-pp82-ppwq- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120, CWE-121, CWE-787
- Updated
- 2026-11-02
OSV
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
CVE-2024-43700- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-43700
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
DEBIAN-CVE-2024-43700- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-43700
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
- Record
UBUNTU-CVE-2024-43700- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-7192-1 No score
xfpt vulnerability
It was discovered that xfpt did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash or execute arbitrary code.
- Record
USN-7192-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xfptDebian:12 |
before 0.11-1+deb12u1, plus listed versions 0.11-1 |
0.11-1+deb12u1 |
xfptDebian:13 |
before 1.00-3 | 1.00-3 |
xfptDebian:14 |
before 1.00-3 | 1.00-3 |
xfptDebian:11 |
before 0.11-1+deb11u1, plus listed versions 0.11-1 |
0.11-1+deb11u1 |
xfptUbuntu:16.04:LTS |
All versions, plus listed versions 0.09-2 |
None known |
xfptUbuntu:18.04:LTS |
All versions, plus listed versions 0.09-20.09-2build1 |
None known |
xfptUbuntu:20.04:LTS |
All versions, plus listed versions 0.10-1 |
None known |
xfptUbuntu:22.04:LTS |
before 0.11-1ubuntu0.1, plus listed versions 0.11-1 |
0.11-1ubuntu0.1 |
xfptUbuntu:24.04:LTS |
before 1.00-2ubuntu0.24.04.1, plus listed versions 1.00-2 |
1.00-2ubuntu0.24.04.1 |
xfptUbuntu:25.10 |
All versions, plus listed versions 1.00-3 |
None known |
xfptUbuntu:26.10 |
All versions, plus listed versions 1.00-3build1 |
None known |
xfptUbuntu:26.04:LTS |
All versions, plus listed versions 1.00-31.00-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-43700 is a high vulnerability (CVSS 7.8) in Philip Hazel Xfpt, published August 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in xfpt 0.11-1+deb12u1.