CVE-2024-55884

CVSS 9 CRITICALEPSS 1.3%CWE-787

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Dec 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.

CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/mullvad/mullvadvpn-app/commit/ef6c862071b26023802b00d6e1dc6ca53d1ab3e6 https://news.ycombinator.com/item?id=42390768 https://x41-dsec.de/news/2024/12/11/mullvad/