CVE-2024-58392
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
35/100
Published: 2026-10-14
Modified: 2026-11-09
First seen: 2026-11-09
Status: active
Attack Surface
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
None
VI:
None
VA:
Low
Description
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.