{"id":"CVE-2024-10934","aliases":["EUVD-2024-33357","GHSA-cx22-p4ff-962q"],"status":"published","title":"OpenBSD NFS double-free vulnerability","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00436,"percentile":0.38346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-415","CWE-457"],"published":"2024-11-15T19:20:02Z","modified":"2026-06-17T06:56:43Z","products":[{"vendor":"openbsd","product":"openbsd"}],"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig","tags":["Patch"]},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10934"},{"url":"https://github.com/advisories/GHSA-cx22-p4ff-962q"}],"sources":{"cve":[{"id":"CVE-2024-10934","title":"OpenBSD NFS double-free vulnerability","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","status":"published","published":"2024-11-15T19:20:02.231Z","modified":"2025-10-02T14:09:00.828Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-415","CWE-457"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2024-33357","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","status":"published","published":"2024-11-15T19:20:02Z","modified":"2025-10-02T14:09:00Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y","level":"critical"}],"updated_at":"2026-11-02T20:31:37.123578Z"}],"ghsa":[{"id":"GHSA-cx22-p4ff-962q","title":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double...","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","status":"published","published":"2024-11-15T21:30:47Z","modified":"2024-11-15T21:30:53Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:58:51.906051Z"}],"nvd":[{"id":"CVE-2024-10934","description":"In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.","status":"published","published":"2024-11-15T20:15:17.62Z","modified":"2026-06-17T06:56:43.803Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-415","CWE-457"],"updated_at":"2026-11-02T14:10:37.281254Z"}]}}