CVE-2024-10934: OpenBSD NFS double-free vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-15 · updated 2026-06-17
Weakness: CWE-415

Description

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.

Affected products

OpenBSD: before 7.4; 7.4, 7.4-errata_001, 7.4-errata_002, 7.4-errata_003, 7.4-errata_004, 7.4-errata_005 (+23) — fixed in 7.4

How to fix

Upgrade to a fixed version: OpenBSD 7.4. Check the vendor advisory for mitigations.

References

https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig

Get alerted when CVE-2024-10934 or the next vulnerability affects your stack