CVE-2026-24799

Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects dlib: before v19.24.9.

CVSS

No CVSS.

References

Link	Resource
https://github.com/davisking/dlib/pull/3063

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Escritura fuera de límites, Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en davisking dlib (módulos dlib/external/zlib). Esta vulnerabilidad está asociada con los archivos de programa inflate.C. Este problema afecta a dlib: antes de la v19.24.9.

27 Jan 2026, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-27 09:15

Updated : 2026-06-17 10:23

NVD link : CVE-2026-24799

Mitre link : CVE-2026-24799

CVE.ORG link : CVE-2026-24799

JSON object : View

Products Affected

No product.

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-787

Out-of-bounds Write

{"id": "CVE-2026-24799", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24799", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T15:29:05.640071Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve_disclosure@tech.gov.sg", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 5.2, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve_disclosure@tech.gov.sg", "affectedData": [{"vendor": "davisking", "modules": ["dlib/external/zlib"], "product": "dlib", "versions": [{"status": "affected", "version": "0", "lessThan": "v19.24.9", "versionType": "git"}], "programFiles": ["inflate.c"], "collectionURL": "https://github.com/davisking/dlib", "defaultStatus": "affected"}]}], "published": "2026-01-27T09:15:49.787", "references": [{"url": "https://github.com/davisking/dlib/pull/3063", "source": "cve_disclosure@tech.gov.sg"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve_disclosure@tech.gov.sg", "description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects dlib: before v19.24.9."}, {"lang": "es", "value": "Escritura fuera de l\u00edmites, Copia de b\u00fafer sin verificar el tama\u00f1o de la entrada ('Desbordamiento de b\u00fafer cl\u00e1sico') vulnerabilidad en davisking dlib (m\u00f3dulos dlib/external/zlib). Esta vulnerabilidad est\u00e1 asociada con los archivos de programa inflate.C.\n\nEste problema afecta a dlib: antes de la v19.24.9."}], "lastModified": "2026-06-17T10:23:36.620", "sourceIdentifier": "cve_disclosure@tech.gov.sg"}