CVE-2020-24336

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-11 · updated 2026-06-17
Weakness: CWE-120

Description

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. Therefore, when copying an address of an arbitrary length, a buffer overflow can occur. This bug can be exploited whenever NAT64 is enabled.

Affected products

contiki-ng: through 4.5
Contiki-Os Contiki: through 3.0

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
https://www.kb.cert.org/vuls/id/815128
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
https://www.kb.cert.org/vuls/id/815128

Get alerted when CVE-2020-24336 or the next vulnerability affects your stack