CVE-2024-42331: Use after free in browser_push_error

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd->browser heap pointer is freed by garbage collection.

Affected products

Zabbix: from 7.0.0 before 7.0.4 — fixed in 7.0.4

How to fix

Upgrade to a fixed version: Zabbix 7.0.4. Check the vendor advisory for mitigations.

References

https://support.zabbix.com/browse/ZBX-25627
https://lists.debian.org/debian-lts-announce/2024/12/msg00005.html

Get alerted when CVE-2024-42331 or the next vulnerability affects your stack