How severe is CVE-2004-2372?

CVE-2004-2372 has a CVSS 2.0 base score of 7.2, rated high severity.

Is CVE-2004-2372 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2004-2372?

CVE-2004-2372 affects Bochs Project Bochs. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2004-2372?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2004-2372 published?

CVE-2004-2372 was published on 2004-12-31 and last updated on 2026-06-16.

CVE-2004-2372

CVE-2004-2372 is a high-severity vulnerability in Bochs Project Bochs with a CVSS 2.0 base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.2)
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Bochs Project Bochs
Published: 2004-12-31
Last modified: 2026-06-16

Description

Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that Bochs be installed setuid root, so this should be treated as a vulnerability.

Frequently asked questions

What is CVE-2004-2372?: Buffer overflow in Bochs before 2.1.1, if installed setuid, allows local users to execute arbitrary code via a long HOME environment variable, which is used if the .bochsrc, bochsrc, and bochsrc.txt cannot be found in a known path. NOTE: some external documents recommend that Bochs be installed setuid root, so this should be treated as a vulnerability.
How severe is CVE-2004-2372?: CVE-2004-2372 has a CVSS 2.0 base score of 7.2, rated high severity.
Is CVE-2004-2372 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2004-2372?: CVE-2004-2372 affects Bochs Project Bochs. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2004-2372?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2004-2372 published?: CVE-2004-2372 was published on 2004-12-31 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:bochs_project:bochs:*:*:*:*:*:*:*:*

More vulnerabilities in Bochs Project Bochs

CVE-2018-25220 — Critical (CVSS 9.8): Bochs 2.6-5 contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by…
CVE-2007-2893 — High (CVSS 7.2): Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs…
CVE-2007-2894 — Low (CVSS 2.1): The emulated floppy disk controller in Bochs 2.3 allows local users of the guest operating system to cause a denial of…

All CVEs affecting Bochs Project Bochs →