CVE-2026-24875

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24875", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "state": "PUBLISHED", "assignerShortName": "GovTech CSG", "dateReserved": "2026-01-27T15:46:29.599Z", "datePublished": "2026-01-27T15:55:48.365Z", "dateUpdated": "2026-01-27T21:34:47.119Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "modizer", "vendor": "yoyofr", "versions": [{"lessThan": "4.1.1", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "TITAN Team (titancaproject@gmail.com)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Integer Overflow or Wraparound vulnerability in yoyofr modizer.<p>This issue affects modizer: before 4.1.1.</p>"}], "value": "Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T15:55:48.365Z"}, "references": [{"url": "https://github.com/yoyofr/modizer/pull/133"}], "source": {"discovery": "UNKNOWN"}, "title": "Integer overflow in modizer", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:06:31.078443Z", "id": "CVE-2026-24875", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:34:47.119Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T21:06:31.078443Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:06:33.720Z"}}], "cna": {"title": "Integer overflow in modizer", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "TITAN Team (titancaproject@gmail.com)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "yoyofr", "product": "modizer", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.1", "versionType": "git"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/yoyofr/modizer/pull/133"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.", "supportingMedia": [{"type": "text/html", "value": "Integer Overflow or Wraparound vulnerability in yoyofr modizer.<p>This issue affects modizer: before 4.1.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "shortName": "GovTech CSG", "dateUpdated": "2026-01-27T15:55:48.365Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24875", "state": "PUBLISHED", "dateUpdated": "2026-01-27T21:34:47.119Z", "dateReserved": "2026-01-27T15:46:29.599Z", "assignerOrgId": "1a37b84a-8e51-4525-b3d6-87e2fae01dbd", "datePublished": "2026-01-27T15:55:48.365Z", "assignerShortName": "GovTech CSG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "modizer", "vendor": "yoyofr", "versions": [{"lessThan": "4.1.1", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "cve_disclosure@tech.gov.sg"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de entero o ajuste circular en yoyofr modizer. Este problema afecta a modizer: antes de 4.1.1."}], "id": "CVE-2026-24875", "lastModified": "2026-06-17T10:23:44.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24875", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:06:31.078443Z", "version": "2.0.3"}}]}, "published": "2026-01-27T16:16:37.013", "references": [{"source": "cve_disclosure@tech.gov.sg", "url": "https://github.com/yoyofr/modizer/pull/133"}], "sourceIdentifier": "cve_disclosure@tech.gov.sg", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "cve_disclosure@tech.gov.sg", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:09:48.464843+00:00", "value": {"mitigation_remediation": ["Upgrade yoyofr modizer to version 4.1.1 or newer to eliminate the overflow defect.", "If an immediate upgrade is not possible, apply the patch detailed in GitHub pull request 133 to the source code before rebuilding the package.", "Implement input validation or limit the range of numeric values that modizer accepts so that an overflow cannot be triggered even if the patch is not applied immediately."], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of yoyofr modizer that are versions earlier than 4.1.1. The tool is used in environments where the modizer package is rendered by yoyofr.", "description_and_impact": "An integer overflow or wraparound condition exists in yoyofr modizer, allowing an attacker to supply numeric input that causes arithmetic operations to wrap incorrectly. The resulting improper value can lead to buffer overflows or corrupted memory that may be exploited to execute arbitrary code or gain unauthorized system access. The flaw is classified as CWE\u2011190 and the CVSS score of 7.8 indicates a high likelihood of significant harm if exploited.", "risk_and_exploitability": "The CVSS score of 7.8 denotes a severe impact, while the EPSS of less than 1% indicates a low probability of exploitation at the time of assessment. It is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Based on the description, it is inferred that an attacker could trigger the overflow by crafting specially crafted input, potentially via a web interface or API that passes numeric values to the modizer module. The attack vector is likely remote if the module is exposed to external users."}}}}, "created": "2026-01-27T20:16:40.581676+00:00", "updated": "2026-04-18T02:15:05.891188+00:00", "vendors": ["yoyofr", "yoyofr$PRODUCT$modizer"]}