CVE-2024-58392

Deferred Deferred - Pending Action

Out-of-Bounds Read in PhysicsFS

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2024-58392

EUVD

EUVD-2024-55799

Affected Vendors & Products

Vendor	Product	Version / Range
icculus	PhysicsFS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in PhysicsFS 3.2.0's UTF-8 string handling function __PHYSFS_utf8codepoint(). When processing six-octet UTF-8 sequences, the function incorrectly advances the cursor by one extra byte, causing it to read past the end of the string buffer. This happens because six-octet UTF-8 sequences are illegal but the function attempts to parse them. Attackers can exploit this by crafting archives with malicious filenames to trigger crashes or memory corruption.

Detection Guidance

To detect this vulnerability, inspect applications using PhysicsFS version 3.2.0 or earlier. Check for crashes during file operations involving UTF-8 filenames, especially archives with malformed six-octet UTF-8 sequences. Use AddressSanitizer or similar tools to identify out-of-bounds reads in physfs_unicode.c.

Impact Analysis

This vulnerability can cause applications using PhysicsFS to crash due to out-of-bounds memory reads. It may lead to denial-of-service conditions when processing maliciously crafted archives. The impact is limited to reading adjacent memory and does not allow code execution or data modification. Users should update to a patched version of PhysicsFS to avoid crashes.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards. It is a medium-severity out-of-bounds read issue in PhysicsFS that could cause application crashes but does not involve unauthorized data access, disclosure, or modification. Standards like GDPR and HIPAA focus on data protection, integrity, and availability, which are not directly compromised by this flaw.

Mitigation Strategies

Upgrade PhysicsFS to a version containing the fix (commit 8a90802 or later). If upgrading is not possible, avoid processing untrusted archives with filenames containing non-ASCII or malformed UTF-8 sequences. Apply input validation to reject six-octet UTF-8 sequences.

Hi! I’m here to help you understand CVE-2024-58392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70