{"id":"CVE-2024-37407","aliases":["AZL-42471","EUVD-2024-36641","GHSA-xjwr-37fp-hq82","ROOT-OS-DEBIAN-12-CVE-2024-37407"],"status":"published","title":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name...","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00971,"percentile":0.62342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-06-08T00:00:00Z","modified":"2026-10-28T10:44:09Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libarchive","fixed_in":["3.7.1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libarchive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-2"}]}]}],"products":[{"vendor":"libarchive","product":"libarchive"}],"references":[{"url":"https://github.com/libarchive/libarchive/pull/2145","tags":["x_transferred","Exploit","Issue Tracking","fix"]},{"url":"https://github.com/libarchive/libarchive/commit/b6a979481b7d77c12fa17bbed94576b63bbcb0c0","tags":["x_transferred","Issue Tracking","fix"]},{"url":"https://github.com/libarchive/libarchive/releases/tag/v3.7.4","tags":["x_transferred","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37407","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xjwr-37fp-hq82"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37407.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-37407","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T00:00:00Z","modified":"2025-03-14T16:00:17.183Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:00.929382Z"}],"euvd":[{"id":"EUVD-2024-36641","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T00:00:00Z","modified":"2025-03-14T16:00:17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:03.250545Z"}],"ghsa":[{"id":"GHSA-xjwr-37fp-hq82","title":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name...","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T15:31:18Z","modified":"2024-07-17T21:32:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:57:42.487659Z"}],"nvd":[{"id":"CVE-2024-37407","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T13:15:58.337Z","modified":"2026-06-17T07:38:18.687Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:10:04.111836Z"}],"osv":[{"id":"AZL-42471","title":"CVE-2024-37407 affecting package libarchive for versions less than 3.7.1-2","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T13:15:58Z","modified":"2026-04-21T04:52:25.456642Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2024-37407","description":"Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.","status":"published","published":"2024-06-08T00:00:00Z","modified":"2026-10-28T10:44:09.059316756Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-37407","title":"CVE-2024-37407 in rootio-libarchive - Patched by Root","description":"Root has patched CVE-2024-37407 in the rootio-libarchive package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-19T07:09:00Z","modified":"2026-08-27T14:00:05.322230565Z","updated_at":"2026-11-02T15:53:30.70924Z"}]}}