CVE intelligence

CVE-2024-2961

Vulnerability intelligence

Published Apr 17, 2024Sources checked Nov 14, 2026

7.3HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2024-2961 and is rated High severity with a CVSS score of 7.3. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

Public exploit: Cataloged public exploit.

Rapid7 Metasploit: CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961) (2026-09-23 21:40:29.350562+00)
Rapid7 catalogs an exploit module for this CVE. Module availability does not establish exploitation in the wild or applicability to your environment.

CISA KEVNot listedBased on the latest collected catalog

EPSS88.3%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2024-2961?

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Source: NVD