CVE-2024-2961
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to...
- Published
- Apr 17, 2024
- Updated
- Oct 15, 2026
- Assigning CNA
- glibc
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Sources
php/CVE-2024-2961
PHP File Read to Remote Code Execution Through GNU C Library Iconv (CVE-2024-2961)
Vulhub vulnerability labsDeclared conditions
- lab image version: vulhub/php:8.3.4-apache(php/CVE-2024-2961/docker-compose.yml:services.web.image)
modules/exploits/linux/http/magento_xxe_to_glibc_buf_overflow.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/magento_xxe_to_glibc_buf_overflow.platform)
- verification: check_declared($.exploit_linux/http/magento_xxe_to_glibc_buf_overflow.check)
- CVE-2024-2961Exploit
Exploits CVE-2024-2961 to read arbitrary files from vulnerable PHP applications using filter chain payloads.
- cnext-exploitsExploit
Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()
- osTicketFileReadIntoRCEExploit
Full-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.
- test_iconvPoC
This repository contains a C program to test for CVE-2024-2961, a buffer overflow vulnerability in the iconv() function of glibc.
Proof-of-concept exploit for CVE-2024-2961, leveraging iconv encoding flaws and PHP filter chains to read arbitrary files from vulnerable servers via crafted payload uploads.
Python exploit for CVE-2023-26326 (WordPress BuddyForms) chained with CVE-2024-2961 to achieve unauthenticated remote code execution via php://filter on PHP 8+.
Exploit for CVE-2023-26326 in the WordPress BuddyForms plugin, leveraging CVE-2024-2961 for remote code execution. This exploit bypasses PHP 8+ deserialization limitations by chaining vulnerabilities with php://filter.
- CVE-2024-2961-XXE-ExploitExploit
CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel
- CVE-2024-2961Patch
CVE-2024–2961 Security Issue Mitigation Script
- CVE-2024-2961Exploit
CVE-2024-2961 Cnext RCE Exploit with Buddyforms 2.7.7
- iconvfixPatch
Bash script to patch for CVE-2024-2961
Proof-of-concept exploit for CVE-2024-2961, demonstrating a remote code execution vulnerability in PHP's iconv function. Designed for security testing and vulnerability validation.
- FIX-CVE-2024-2961Patch
Quick mitigation script
PHP RCE CVE-2024-2961 Nucleus Hackathon Demo
- cve-2024-2961Exploit
Custom C exploit for CVE-2024-2961 targeting iconv buffer overflow, enabling remote code execution via crafted input. Based on ambionics/cnext-exploits.
- wongpressResearch
A WordPress demo lab for CVE-2024-2961 & CVE-2024-29510
CVE-2026-22200: Arbitrary file read + CNEXT RCE in osTicket
CVE-2022-31626, CVE-2024-2961, CVE-2019-6977, PHP security research
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.