CVE-2024-42381
CVE-2024-42381 is a high-severity vulnerability with a CVSS 3.x base score of 8.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-830.
Key facts
- Severity: High (CVSS 3.x base score 8.3)
- EPSS exploit prediction: 1% (45th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-39586
- Weakness: CWE-830
- Published:
- Last modified:
Description
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)
Frequently asked questions
- What is CVE-2024-42381?
- os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary relocation phase, which occurs before a user would expect execution of downloaded package content. (237d1e783f7ee261beaba7d3f6bde22da7148b0a was the tested vulnerable version.)
- How severe is CVE-2024-42381?
- CVE-2024-42381 has a CVSS 3.x base score of 8.3, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2024-42381 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2024-42381?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-42381 have an EU (EUVD) identifier?
- Yes. CVE-2024-42381 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39586.
- When was CVE-2024-42381 published?
- CVE-2024-42381 was published on 2024-07-31 and last updated on 2026-06-17.
References
- https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/
- https://brew.sh/2024/07/30/homebrew-security-audit/
- https://github.com/Homebrew/brew/commit/916b37388d3851a8a93a8e9b4adc38873680ead7
- https://github.com/Homebrew/brew/pull/17136
- https://github.com/Homebrew/brew/releases/tag/4.2.20
- https://github.com/Homebrew/brew/tree/237d1e783f7ee261beaba7d3f6bde22da7148b0a
- https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf
Other CWE-830 vulnerabilities
- CVE-2023-2588 — High (CVSS 8.8): Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed…
- CVE-2025-65109 — High (CVSS 8.5): Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf…
- CVE-2024-29944 — High (CVSS 8.4): An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript…
- CVE-2025-46652 — Medium (CVSS 6.1): In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an…
- CVE-2025-43703 — Medium (CVSS 6.1): An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access…
- CVE-2025-33028 — Medium (CVSS 6.1): In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.…