{"id":"CVE-2024-43598","aliases":["CLSA-2026-1776904627","EUVD-2024-40349","GHSA-2586-f3p4-hq84","PYSEC-2024-231"],"status":"published","title":"LightGBM Remote Code Execution Vulnerability","description":"LightGBM Remote Code Execution Vulnerability","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01415,"percentile":0.72946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2024-11-12T17:53:58Z","modified":"2026-11-03T21:52:39Z","fixes":[{"ecosystem":"PyPI","package":"lightgbm","fixed_in":["4.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:PyPI","package":"lightgbm","fixed_in":["3.3.5.post1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lightgbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"4.6.0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"lightgbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.5"},{"fixed":"3.3.5.post1+tuxcare"}]}],"versions":["3.3.5"]},{"source":"osv","ecosystem":"PyPI","package":"lightgbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"4.6.0"}]}],"versions":["2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","3.0.0","3.0.0rc1","3.1.0","3.1.1","3.2.0","3.2.1","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","4.0.0","4.1.0","4.2.0","4.3.0","4.4.0","4.5.0"]},{"source":"osv","ecosystem":"PyPI","package":"lightgbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0"}]}],"versions":["2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","3.0.0","3.0.0rc1","3.1.0","3.1.1","3.2.0","3.2.1","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","4.0.0","4.1.0","4.2.0","4.3.0","4.4.0","4.5.0"]}],"products":[{"vendor":"microsoft","product":"lightgbm"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598","tags":["vendor-advisory","Patch","Vendor Advisory","web","advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43598","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lightgbm/PYSEC-2024-231.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2586-f3p4-hq84","tags":["advisory"]},{"url":"https://github.com/microsoft/LightGBM","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-43598","title":"LightGBM Remote Code Execution Vulnerability","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T17:53:58.216Z","modified":"2026-11-04T00:03:21.272Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-04T00:47:47.540303Z"}],"euvd":[{"id":"EUVD-2024-40349","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T17:53:58Z","modified":"2026-11-04T00:03:21Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-04T01:51:27.299093Z"}],"ghsa":[{"id":"GHSA-2586-f3p4-hq84","title":"LightGBM Remote Code Execution Vulnerability","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:30:58Z","modified":"2025-02-18T19:25:53Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2024-43598","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:15:28.277Z","modified":"2026-11-03T22:17:23.853Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-04T00:47:54.173626Z"}],"osv":[{"id":"GHSA-2586-f3p4-hq84","title":"LightGBM Remote Code Execution Vulnerability","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:30:58Z","modified":"2025-02-18T19:41:59.478178Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"PYSEC-2024-231","description":"LightGBM Remote Code Execution Vulnerability","status":"published","published":"2024-11-12T18:15:28Z","modified":"2026-06-10T17:02:04.452933111Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"CLSA-2026-1776904627","title":"TuxCare security update for lightgbm (1 CVE)","description":"TuxCare rebuilt lightgbm to address 1 CVE. Fixed in 3.3.5.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:48:04.92068605Z","updated_at":"2026-11-02T15:43:44.384419Z"}]}}