How severe is CVE-2024-8374?

CVE-2024-8374 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-8374 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-8374?

CVE-2024-8374 primarily affects Ultimaker Ultimaker Cura. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-8374?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-8374 have an EU (EUVD) identifier?

Yes. CVE-2024-8374 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49132.

When was CVE-2024-8374 published?

CVE-2024-8374 was published on 2024-09-03 and last updated on 2026-06-17.

CVE-2024-8374

CVE-2024-8374 is a high-severity vulnerability in Ultimaker Ultimaker Cura with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-49132
Weakness: CWE-94
Affected product: Ultimaker Ultimaker Cura
Published: 2024-09-03
Last modified: 2026-06-17

Description

UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerability arises from improper handling of the drop_to_buildplate property within 3MF files, which are ZIP archives containing the model data. When a 3MF file is loaded in Cura, the value of the drop_to_buildplate property is passed to the Python eval() function without proper sanitization, allowing an attacker to execute arbitrary code by crafting a malicious 3MF file. This vulnerability poses a significant risk as 3MF files are commonly shared via 3D model databases.

Frequently asked questions

What is CVE-2024-8374?: UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/plugins/ThreeMFReader.py). The vulnerability arises from improper handling of the drop_to_buildplate property within 3MF files, which are ZIP archives containing the model data. When a 3MF file is loaded in Cura, the value of the drop_to_buildplate property is passed to the Python eval() function without proper sanitization, allowing an attacker to execute arbitrary code by crafting a malicious 3MF file. This vulnerability poses a significant risk as 3MF files are commonly shared via 3D model databases.
How severe is CVE-2024-8374?: CVE-2024-8374 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-8374 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-8374?: CVE-2024-8374 primarily affects Ultimaker Ultimaker Cura. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-8374?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-8374 have an EU (EUVD) identifier?: Yes. CVE-2024-8374 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-49132.
When was CVE-2024-8374 published?: CVE-2024-8374 was published on 2024-09-03 and last updated on 2026-06-17.

References

https://github.com/Ultimaker/Cura/commit/285a241eb28da3188c977f85d68937c0dad79c50

Affected products (7)

cpe:2.3:a:ultimaker:ultimaker_cura:5.7.0:-:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.7.0:beta1:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.7.1:*:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.7.2:rc2:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.8.0:beta1:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.8.0:beta1_rc1:*:*:*:*:*:*
cpe:2.3:a:ultimaker:ultimaker_cura:5.8.0:beta1_rc2:*:*:*:*:*:*

More vulnerabilities in Ultimaker Ultimaker Cura

CVE-2024-51330 — Medium (CVSS 5.1): An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via…

All CVEs affecting Ultimaker Ultimaker Cura →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →