CVE-2024-54028: catdoc Integer Underflow (Wrap or Wraparound)
Vulnerability summary
CVE-2024-54028 is a high (CVSS 8.4) Integer Underflow (Wrap or Wraparound) vulnerability in catdoc. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 02-06-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.01 pp
From 0.31% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (talosintelligence.com)
Maturity: unknown
Exploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- catdoc< 1:0.95-6~deb12u1 | < 1:0.95-6
- debian_linuxEOL11.0
Catdoc1 product
- catdoc0.95
Fossies1 product
- catdoc0.95
Ubuntu1 product
- catdoc< 1:0.94.3~git20160113.dbc9ec6+dfsg-1+deb9u1ubuntu0.1~esm1 | < 1:0.95-4.1ubuntu0.18.04.1~esm1 | < 1:0.95-4.1ubuntu0.20.04.1~esm1 | < 1:0.95-5ubuntu0.22.04.1~esm1 | < 1:0.95-5ubuntu0.24.04.1~esm1 | All versions (No fix recorded)
4 vendors · 5 products
