What is CVE-2024-47611?

CVE-2024-47611 is a vulnerability in Tukaani-project Xz, classified under Argument Injection. Published 2024-10-02.

Is CVE-2024-47611 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Tukaani-project Xz

CVE-2024-47611

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerabili…

EPSS: 0.008 (51.1th percentile) — read the EPSS interpretation.

Affected products

Tukaani-project Xz — versions < 5.6.3

Weakness classification (CWE)

CWE-88 — Argument Injection
CWE-176

Public proof-of-concept exploits

greydoubt/xz
fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-47611?: CVE-2024-47611 is a vulnerability in Tukaani-project Xz, classified under Argument Injection. Published 2024-10-02.
Is CVE-2024-47611 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.