{"id":"CVE-2024-37676","aliases":["ALPINE-CVE-2024-37676","AZL-42826","EUVD-2024-36802","GHSA-j7q8-96xp-m3gc","UBUNTU-CVE-2024-37676","openSUSE-SU-2026:11531-1","openSUSE-SU-2026:21585-1"],"status":"published","title":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the...","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00203,"percentile":0.10327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2024-06-20T00:00:00Z","modified":"2026-11-02T11:17:50Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"htop","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"htop","fixed_in":["3.4.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"htop","fixed_in":["3.5.3-r0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"htop","fixed_in":["3.5.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"htop","fixed_in":["3.5.3-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.5-5"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0-2","2.2.0-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"htop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-bp160.1.1"}]}]}],"products":[{"vendor":"htop","product":"htop"}],"references":[{"url":"https://github.com/htop-dev/htop","tags":["x_transferred","report"]},{"url":"https://gist.github.com/Cirno9-dev/0109cde3bdbe7eccc6770515106740b7","tags":["x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37676","tags":["web"]},{"url":"http://htop.com","tags":["report"]},{"url":"https://github.com/advisories/GHSA-j7q8-96xp-m3gc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-37676","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-37676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37676","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37676","tags":["web"]},{"url":"https://bugzilla.suse.com/1226729","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-37676","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T00:00:00Z","modified":"2026-07-09T00:31:19.792Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36802","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T00:00:00Z","modified":"2026-07-09T00:31:19Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:04.895477Z"}],"ghsa":[{"id":"GHSA-j7q8-96xp-m3gc","title":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the...","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T18:34:08Z","modified":"2024-08-01T15:32:57Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:57:48.682212Z"}],"nvd":[{"id":"CVE-2024-37676","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T16:15:13.917Z","modified":"2026-07-09T01:19:04.997Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:10:07.173605Z"}],"osv":[{"id":"ALPINE-CVE-2024-37676","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T16:15:13.917Z","modified":"2026-11-02T11:17:50.09809707Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"UBUNTU-CVE-2024-37676","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T16:15:00Z","modified":"2025-10-24T05:10:14Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"AZL-42826","title":"CVE-2024-37676 affecting package htop 3.0.5-5","description":"An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.","status":"published","published":"2024-06-20T16:15:13Z","modified":"2026-04-21T04:30:46.133507Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"openSUSE-SU-2026:11531-1","title":"htop-3.5.3-1.1 on GA media","description":"These are all security issues fixed in the htop-3.5.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-08-18T09:30:04.62935709Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21585-1","title":"Security update for htop","description":"This update for htop fixes the following issues:\n\nChanges in htop:\n\n- Update to version 3.5.3:\n  * Improve the htoprc settings parser to avoid segfaults on\n    tampered configuration files (sanitised sort keys, validated\n    configuration invariants, NULL safety for header columns and\n    screens)\n  * Add zswap pool usage meters\n  * Fix out-of-bounds access when parsing the power supply type\n    (Linux)\n  * Mark a CPU offline when it is unplugged from the middle and\n    release its data on hot-unplug (Linux)\n  * Fix a Clang MemorySanitizer-reported issue\n  * Exit follow mode when a search or filter is cancelled\n  * Fix blank STARTTIME and wrong ELAPSED for threads (Darwin)\n  * Use strchr instead of strstr in XUtils\n  * Document the CPU meter segments in the man page and add an\n    External Libraries section covering libnl-3/libnl-genl-3\n- CVE-2024-37676: out-of-bounds access in\n  Header_populateFromSettings reachable from a tampered htoprc;\n  the settings parser hardening above is what upstream lists as\n  covering it. openSUSE is assessed not affected (boo#1226729)\n","status":"published","published":"2026-08-17T17:00:32Z","modified":"2026-08-18T18:23:35.042325642Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}