CVE-2024-54028 HIGH

CVE-2024-54028

Vendor Catdoc

Product catdoc

Weakness CWE-191

Published June 2, 2025

Last update November 3, 2025

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Key dates

02Disclosure timeline

June 2, 2025 CVE published

November 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-54028 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/191.html

Related vulnerabilities

04Related CVE

CVE-2026-5778 Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path. CVE-2021-37706 Potential integer underflow upon receiving STUN message in PJSIP CVE-2023-33059 Buffer Copy Without Checking Size of Input in Audio CVE-2025-52471 ESP-NOW Integer Underflow Vulnerability Advisory CVE-2026-33184 nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic