{"id":"CVE-2024-2002","title":"Libdwarf: crashes randomly on fuzzed object","summary":"A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-415"],"vendor":"Red Hat","product":"libdwarf","affected":["libdwarf 0.1.0","libdwarf","libdwarf"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-08-28T15:05:19.693453Z"},"published":"2024-03-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:44:13.594Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-2002","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-2002"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2267700","label":"RHBZ#2267700"},{"url":"https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt"}],"tags":["cve.org"],"epss":0.01089,"epssPercentile":0.6544,"ingestedAt":"2026-11-05T21:36:00.827Z","slug":"CVE-2024-2002","body":"## Overview\n\nA double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.\n\n## Affected\n\n- `libdwarf 0.1.0`\n- `libdwarf`\n- `libdwarf`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}