CVE-2024-3209

CVE-2024-3209 is a critical heap-based buffer overflow vulnerability affecting UPX versions up to 4.2.2, specifically within the get_ne64 function of the bele.h file. This flaw impacts various Fedora Project distributions and the UPX utility itself. With a CVSS score of 9.8, it presents a severe risk, allowing unauthenticated attackers to achieve full compromise of confidentiality, integrity, and availability with low attack complexity. While the exploit has been publicly disclosed, there is no evidence of active exploitation in the wild, nor are there readily available Metasploit, Nuclei, or ExploitDB modules. Community discussion is minimal, and the vendor has not responded to disclosure attempts.