CVE-2024-56522
TCPDF has incorrect comparison
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
CVE-2024-56522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
EUVDEUVD-2024-3618
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
EUVD-2024-3618- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w95c-7994-ghpr
TCPDF has incorrect comparison
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
GHSA-w95c-7994-ghpr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-697, CWE-843
- Updated
- 2026-11-02
NVD
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
CVE-2024-56522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-843
- Updated
- 2026-11-02
OSV
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
CVE-2024-56522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-56522
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
DEBIAN-CVE-2024-56522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-w95c-7994-ghpr
TCPDF has incorrect comparison
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
GHSA-w95c-7994-ghpr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-697, CWE-843
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-56522
An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
- Record
UBUNTU-CVE-2024-56522- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2025-0059 No score
Updated php-tcpdf packages fix security vulnerabilities
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. (CVE-2024-56522) An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. (CVE-2024-56527)
- Record
MGASA-2025-0059- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tecnickcom/tcpdfPackagist |
before 6.8.0 | 6.8.0 |
tcpdfDebian:12 |
before 6.6.2+dfsg1-1+deb12u1, plus listed versions 6.6.2+dfsg1-1 |
6.6.2+dfsg1-1+deb12u1 |
tcpdfDebian:13 |
before 6.8.0+dfsg-1 | 6.8.0+dfsg-1 |
tcpdfDebian:14 |
before 6.8.0+dfsg-1 | 6.8.0+dfsg-1 |
tcpdfDebian:11 From an advisory covering 8 CVEs |
before 6.3.5+dfsg1-1+deb11u1, plus listed versions 6.3.5+dfsg1-1 |
6.3.5+dfsg1-1+deb11u1 |
tcpdfDebian:12 From an advisory covering 8 CVEs |
before 6.6.2+dfsg1-1+deb12u1, plus listed versions 6.6.2+dfsg1-1 |
6.6.2+dfsg1-1+deb12u1 |
tecnickcom/tcpdfPackagist |
before 6.8.0, plus listed versions 6.0.0136.0.0146.0.0156.0.0166.0.017 Show 45 moreShow less6.0.0186.0.0196.0.0206.0.0216.0.0226.0.0236.0.0246.0.0256.0.0266.0.0276.0.0286.0.0296.0.0306.0.0316.0.0326.0.0336.0.0346.0.0356.0.0366.0.0376.0.0386.0.0396.0.0406.0.0416.0.0426.0.0436.0.0446.0.0456.0.0466.0.0476.0.0486.0.0496.0.0506.0.0516.0.0526.0.0536.0.0546.0.0556.0.0566.0.0576.0.0586.0.0596.0.0606.0.0616.0.062 |
6.8.0 |
php-tcpdfMageia:9 From an advisory covering 4 CVEs |
before 6.5.0-1.3.mga9 | 6.5.0-1.3.mga9 |
tcpdfUbuntu:14.04:LTS |
All versions, plus listed versions 6.0.010+dfsg-16.0.021+dfsg-16.0.048+dfsg-16.0.048+dfsg-2 |
None known |
tcpdfUbuntu:16.04:LTS |
All versions, plus listed versions 6.0.093+dfsg-16.0.093+dfsg-1ubuntu1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tcpdfUbuntu:18.04:LTS |
All versions, plus listed versions 6.2.12+dfsg2-1ubuntu16.2.13+dfsg-16.2.13+dfsg-1ubuntu1 |
None known |
tcpdfUbuntu:20.04:LTS |
All versions, plus listed versions 6.2.13+dfsg-1ubuntu16.3.2+dfsg1-16.3.4+dfsg1-16.3.5+dfsg1-1 |
None known |
tcpdfUbuntu:22.04:LTS |
All versions, plus listed versions 6.3.5+dfsg1-16.4.2+dfsg1-16.4.4+dfsg1-1 |
None known |
tcpdfUbuntu:24.04:LTS |
All versions, plus listed versions 6.6.2+dfsg1-16.6.5+dfsg-16.7.4+dfsg-16.7.5+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-56522 is a high vulnerability (CVSS 7.5) in Tcpdf Project Tcpdf, published December 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in tecnickcom/tcpdf 6.8.0.
References
tcpdf.org
github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
php.net/manual/en/types.comparisons.php
lists.debian.org/debian-lts-announce/2025/06/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2024-56522
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2024-56522
advisories.mageia.org/MGASA-2025-0059.html
bugs.mageia.org/show_bug.cgi?id=33898
lists.fedoraproject.org/archives/list/[email protected]/message/ZX3ABLKKEVGN4M4BBUJFPBNWW5SHP7J3
ubuntu.com/security/CVE-2024-56522
cve.org/CVERecord?id=CVE-2024-56522
Left out here: 81 versions. The JSON record has them.