{"id":"CVE-2026-24793","aliases":["AZL-75821","AZL-75836","EUVD-2026-4717","GHSA-j644-xc9q-497g"],"status":"published","title":"A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00335,"percentile":0.27258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120","CWE-787"],"published":"2026-01-27T08:19:41Z","modified":"2026-11-05T05:36:30Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-5"}]}]}],"products":[{"vendor":"azerothcore","product":"azerothcore"},{"vendor":"azerothcore","product":"azerothcore-wotlk"}],"references":[{"url":"https://github.com/azerothcore/azerothcore-wotlk/pull/21599","tags":["patch","exploit","Issue Tracking","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24793","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j644-xc9q-497g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24793.json","tags":["advisory"]},{"url":"https://github.com/azerothcore/azerothcore-wotlk","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-24793","title":"A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T08:19:41.35Z","modified":"2026-01-27T21:39:36.88Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-787","CWE-120"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-4717","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T08:19:41Z","modified":"2026-01-27T21:39:36Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical"}],"updated_at":"2026-11-02T19:48:46.818498Z"}],"ghsa":[{"id":"GHSA-j644-xc9q-497g","title":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')...","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T09:30:29Z","modified":"2026-02-17T21:32:16Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T15:06:14.396911Z"}],"nvd":[{"id":"CVE-2026-24793","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T09:15:48.94Z","modified":"2026-06-17T10:23:35.97Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-24793","title":"A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T08:19:41.35Z","modified":"2026-10-28T02:30:34.596265292Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:C/RE:L/U:Red","level":"critical"}],"cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"AZL-75821","title":"CVE-2026-24793 affecting package gdal 3.6.3-2","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T09:15:48Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-75836","title":"CVE-2026-24793 affecting package gdal 3.6.3-5","description":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in azerothcore azerothcore-wotlk (deps/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects azerothcore-wotlk: through v4.0.0.","status":"published","published":"2026-01-27T09:15:48Z","modified":"2026-04-21T04:39:00.236162Z","updated_at":"2026-11-02T15:28:09.474476Z"}]}}