Search threats, CVEs… ⌘K
← Back to CVE intelligence
CVE intelligence

CVE-2024-56433

Vulnerability intelligence

Published Dec 26, 2024Sources checked Oct 3, 2026
3.6LOWCVSS out of 10
What this means

Review the available evidence

CVE-2024-56433 and is rated Low severity with a CVSS score of 3.6. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

CISA KEVNot listedBased on the latest collected catalog
EPSS0.4%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview

What is CVE-2024-56433?

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.