CVE-2024-58392

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58392", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-14T13:07:16.579Z", "datePublished": "2026-10-14T14:16:29.553Z", "dateUpdated": "2026-10-20T00:58:44.924Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:29.553Z"}, "datePublic": "2024-03-25T00:00:00.000Z", "title": "PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint", "descriptions": [{"lang": "en", "value": "PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "icculus", "product": "PhysicsFS", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "3.2.0", "status": "affected", "versionType": "semver"}], "collectionURL": "https://github.com/icculus/physfs", "repo": "https://github.com/icculus/physfs"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/icculus/physfs/issues/79", "tags": ["issue-tracking"]}, {"url": "https://hackmd.io/@haind-pwn/physfs-utf8-decoder-overread", "tags": ["third-party-advisory"]}, {"url": "https://github.com/icculus/physfs/blob/release-3.2.0/src/physfs_unicode.c#L165-L187", "tags": ["technical-description"]}, {"url": "https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5", "tags": ["patch"]}, {"name": "VulnCheck Advisory: PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/physicsfs-through-3.2.0-out-of-bounds-read-via-physfs-utf8codepoint"}], "credits": [{"lang": "en", "value": "guillaume-uH57J9", "type": "finder"}, {"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T00:58:34.588653Z", "id": "CVE-2024-58392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T00:58:44.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T00:58:34.588653Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T00:58:40.306Z"}}], "cna": {"title": "PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint", "credits": [{"lang": "en", "type": "finder", "value": "guillaume-uH57J9"}, {"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/icculus/physfs", "vendor": "icculus", "product": "PhysicsFS", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.0"}], "collectionURL": "https://github.com/icculus/physfs", "defaultStatus": "unaffected"}], "datePublic": "2024-03-25T00:00:00.000Z", "references": [{"url": "https://github.com/icculus/physfs/issues/79", "tags": ["issue-tracking"]}, {"url": "https://hackmd.io/@haind-pwn/physfs-utf8-decoder-overread", "tags": ["third-party-advisory"]}, {"url": "https://github.com/icculus/physfs/blob/release-3.2.0/src/physfs_unicode.c#L165-L187", "tags": ["technical-description"]}, {"url": "https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/physicsfs-through-3.2.0-out-of-bounds-read-via-physfs-utf8codepoint", "name": "VulnCheck Advisory: PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:29.553Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58392", "state": "PUBLISHED", "dateUpdated": "2026-10-20T00:58:44.924Z", "dateReserved": "2026-10-14T13:07:16.579Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-14T14:16:29.553Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/icculus/physfs", "defaultStatus": "unaffected", "product": "PhysicsFS", "repo": "https://github.com/icculus/physfs", "vendor": "icculus", "versions": [{"lessThanOrEqual": "3.2.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application."}, {"lang": "es", "value": "PhysicsFS hasta la versi\u00f3n 3.2.0 incluida contiene una vulnerabilidad de lectura fuera de l\u00edmites en __PHYSFS_utf8codepoint() que permite a los atacantes leer m\u00e1s all\u00e1 de los buffers de nombres mediante un desplazamiento del cursor de un paso en secuencias UTF?8 de seis octetos. Los atacantes pueden proporcionar un archivo comprimido manipulado con nombres de entradas que terminen en secuencias de seis octetos, lo que hace que PHYSFS_utf8stricmp() y el proceso de hash lean m\u00e1s all\u00e1 y provoquen el bloqueo de la aplicaci\u00f3n."}], "id": "CVE-2024-58392", "lastModified": "2026-11-09T10:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58392", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T00:58:34.588653Z", "version": "2.0.3"}}]}, "published": "2026-10-14T15:17:00.660", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/icculus/physfs/blob/release-3.2.0/src/physfs_unicode.c#L165-L187"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/icculus/physfs/issues/79"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haind-pwn/physfs-utf8-decoder-overread"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/physicsfs-through-3.2.0-out-of-bounds-read-via-physfs-utf8codepoint"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "PhysicsFS", "source": "cna", "vendor": "icculus"}, "product": "physicsfs", "vendor": "icculus"}], "created": "2026-10-15T03:00:14.002933+00:00", "updated": "2026-10-19T13:09:05.781547+00:00", "vendors": ["icculus", "icculus$PRODUCT$physicsfs"]}