What’s Vulnerable › Vulnerabilities

CVE-2024-42333: Heap buffer over-read

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-27 · updated 2026-06-17
• Weakness: CWE-126

Description

The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c

Affected products

• Zabbix: from 6.0.0 before 6.0.34; from 6.4.0 before 6.4.19; from 7.0.0 before 7.0.4 — fixed in 6.0.34, 6.4.19, 7.0.4

How to fix

Upgrade to a fixed version: Zabbix 6.0.34, 6.4.19, 7.0.4. Check the vendor advisory for mitigations.

References

• https://support.zabbix.com/browse/ZBX-25629
• https://lists.debian.org/debian-lts-announce/2024/12/msg00005.html

Get alerted when CVE-2024-42333 or the next vulnerability affects your stack