Every CVESearch/Get API key

CVE-2026-24799

A heap-based buffer over-read or buffer overflow in davisking/dlib

5.2 MediumFix available

CVE-2026-24799 is a medium vulnerability (CVSS 5.2) in Davisking Dlib, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in dlib 19.24.9.

What does this mean?
Severity
5.2 MediumCVSS 4.0, CVE List
Exploit chance
0.14%EPSS, 3rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
19.24.9dlib +7 more

Description

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.14%Up 0.1 points since Jan 27, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fltk
Azure Linux:3
through 1.3.8-1None known
gpsbabel
Azure Linux:3
through 1.8.0-4None known
openjpeg2
Azure Linux:3
through 2.3.1-12None known
fltk
Azure Linux:2
through 1.3.5-4None known
gpsbabel
Azure Linux:2
through 1.8.0-4None known
openjpeg2
Azure Linux:2
through 2.3.1-12None known
dlib
PyPI
before 19.24.9, plus listed versions
18.17.10019.0.019.1.019.10.019.12.0
Show 34 moreShow less
19.13.019.13.119.14.019.15.019.16.019.17.019.18.019.19.019.20.019.21.019.21.119.22.019.22.119.23.019.23.119.24.019.24.119.24.219.24.419.24.519.24.619.24.819.3.019.3.119.4.019.5.019.5.119.6.019.6.119.7.019.8.019.8.119.8.219.9.0
19.24.9
dlib
openSUSE:Tumbleweed
before 20.0.1-1.1
20.0.1-1.1

What each source reports

CVE List Score used5.2

A heap-based buffer over-read or buffer overflow in davisking/dlib

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
CVE-2026-24799
CVSS 4.0
5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
Weakness
CWE-787, CWE-120
Updated
2026-11-02
EUVDEUVD-2026-48195.2

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
EUVD-2026-4819
CVSS 4.0
5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
Updated
2026-11-02
GitHub AdvisoriesGHSA-9549-fwq2-p6hg5.2

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')...

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
GHSA-9549-fwq2-p6hg
CVSS 4.0
5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-120
Updated
2026-11-13
NVD5.2

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
CVE-2026-24799
CVSS 4.0
5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Weakness
CWE-120, CWE-787
Updated
2026-11-13
OSV5.2

A heap-based buffer over-read or buffer overflow in davisking/dlib

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
CVE-2026-24799
CVSS 4.0
5.2 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Amber
Weakness
CWE-120, CWE-787
Updated
2026-11-14
OSVPYSEC-2026-43645.6

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
PYSEC-2026-4364
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Updated
2026-11-14
Show 7 moreShow less
OSVAZL-75818No score

CVE-2026-24799 affecting package fltk 1.3.8-1

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75818
Updated
2026-11-05
OSVAZL-75824No score

CVE-2026-24799 affecting package gpsbabel 1.8.0-4

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75824
Updated
2026-11-05
OSVAZL-75827No score

CVE-2026-24799 affecting package openjpeg2 2.3.1-12

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75827
Updated
2026-11-05
OSVAZL-75833No score

CVE-2026-24799 affecting package fltk 1.3.5-4

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75833
Updated
2026-11-02
OSVAZL-75839No score

CVE-2026-24799 affecting package gpsbabel 1.8.0-4

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75839
Updated
2026-11-02
OSVAZL-75842No score

CVE-2026-24799 affecting package openjpeg2 2.3.1-12

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.

This issue affects dlib: before v19.24.9.

Record
AZL-75842
Updated
2026-11-02
OSVopenSUSE-SU-2026:12269-1No score

dlib-devel-20.0.1-1.1 on GA media

These are all security issues fixed in the dlib-devel-20.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12269-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliasesOSV
products, referencesGitHub Advisories, NVD
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open