How severe is CVE-2024-47260?

CVE-2024-47260 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-47260 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-47260?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-47260 have an EU (EUVD) identifier?

Yes. CVE-2024-47260 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54216.

When was CVE-2024-47260 published?

CVE-2024-47260 was published on 2025-03-04 and last updated on 2026-06-17.

CVE-2024-47260

CVE-2024-47260 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-641.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-54216
Weakness: CWE-641
Published: 2025-03-04
Last modified: 2026-06-17

Description

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

Frequently asked questions

What is CVE-2024-47260?: 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API mediaclip.cgi did not have a sufficient input validation allowing for uploading more audio clips then designed resulting in the Axis device running out of memory. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
How severe is CVE-2024-47260?: CVE-2024-47260 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-47260 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-47260?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-47260 have an EU (EUVD) identifier?: Yes. CVE-2024-47260 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54216.
When was CVE-2024-47260 published?: CVE-2024-47260 was published on 2025-03-04 and last updated on 2026-06-17.

References

https://www.axis.com/dam/public/1d/d3/ef/cve-2024-47260pdf-en-US-466883.pdf

Other CWE-641 vulnerabilities

CVE-2026-25177 — High (CVSS 8.8): Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized…
CVE-2025-47953 — High (CVSS 8.4): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-50023 — High (CVSS 8.3): yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a…
CVE-2025-47173 — High (CVSS 7.8): Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-21402 — High (CVSS 7.8): Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2025-21361 — High (CVSS 7.8): Microsoft Outlook Remote Code Execution Vulnerability

Browse all CWE-641 vulnerabilities →