CVE-2024-2961: glibc iconv() ISO-2022-CN-EXT out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.3 and extremely high EPSS (0.8833) indicate a serious memory-corruption flaw in a widely used library, though local vector and lack of KEV listing temper immediate urgency.

What it is

The iconv() function in GNU C Library 2.39 and older can overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This out-of-bounds write can crash an application or overwrite an adjacent variable, making it a memory-corruption issue in a core system library used by many programs.

Impact

An attacker can cause a denial of service via crash or potentially corrupt adjacent memory, which may lead to further exploitation depending on the application context. The CVSS vector indicates low confidentiality and integrity impact with high availability impact.

Attack surface

The flaw is reached locally (AV:L) with no privileges (PR:N) and no user interaction (UI:N), meaning an attacker who can supply input to an application that calls iconv() with the ISO-2022-CN-EXT charset can trigger it. The record does not specify a remote vector, so remote reachability depends on how the vulnerable library is exposed by the calling application.

Exploitation

CVE-2024-2961 is not listed in CISA KEV and has no documented ransomware use, but EPSS is very high at 0.8833 (99.762 percentile), indicating a strong likelihood of exploitation activity. References are mailing lists and vendor advisories, with no public exploit tag in the supplied data.

What to do

• Patch glibc to a version that includes the fix for CVE-2024-2961, and apply vendor updates for NetApp and Debian products listed.
• If immediate patching is not possible, avoid or restrict use of the ISO-2022-CN-EXT character set in applications that call iconv().
• Monitor vendor advisories (NetApp, Debian, Fedora) for updated packages and apply them as they become available.
• Consider runtime mitigations such as memory-safe language rewrites or sandboxing for services that process untrusted input through iconv().

Detection

• Monitor application crashes or abnormal terminations that correlate with iconv() calls or ISO-2022-CN-EXT conversions.
• Use memory corruption detection tools (e.g., ASAN, Valgrind) in test or staging environments to identify out-of-bounds writes in iconv().
• Audit logs for processes that handle untrusted input and invoke iconv() with non-default character sets, especially ISO-2022-CN-EXT.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.