CVE-2012-4024: Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and ea

Q: How do I fix CVE-2012-4024?

squashfs: upgrade to newer than 4.2. Exact commands for each OS are on this page.

Q: Is CVE-2012-4024 being exploited?

CVE-2012-4024 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2012-4024 affect?

CVE-2012-4024 affects squashfs. Severity is medium (CVSS 6.8). Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: pr

Q: How urgent is CVE-2012-4024?

Priority 46/100. EPSS top 9%: very likely to be exploited

This month

MEDIUM 6.8UPGRADE

CVE-2012-4024 is a medium-severity flaw (CVSS 6.8) affecting squashfs. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.

Why this priority

EPSS top 9%: very likely to be exploited

A fixed release or distro patch exists.

Risk facts

CVSS score	6.8 (Medium)
EPSS exploit chance	4.1% (top 9%)
CISA exploited list	No
Weakness	CWE-787
Published	2012-07-19
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: squashfs project

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2012-07-19 19:55 UTCPublished CVE record published
2026-06-16 23:44 UTCUpdated Record last modified

squashfs project squashfs UPGRADE

Affected: <= 4.2

Fixed in: newer than 4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy squashfs || rpm -q squashfs || squashfs --version

2. UPGRADE to newer than 4.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade squashfs

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade squashfs

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-4024?

squashfs: upgrade to newer than 4.2. Exact commands for each OS are on this page.

Is CVE-2012-4024 being exploited?

CVE-2012-4024 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2012-4024 affect?

CVE-2012-4024 affects squashfs. Severity is medium (CVSS 6.8). Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option). NOTE: pr

How urgent is CVE-2012-4024?

Priority 46/100. EPSS top 9%: very likely to be exploited

Related CVEs

CVE-2015-4646 HIGH 7.5 UPGRADE (1) unsquash-1.c, (2) unsquash-2.c, (3) unsquash-3.c, and (4) unsquash-4.c in Squashfs and sasquatch allow rem
CVE-2015-4645 MEDIUM 5.5 UPGRADE MITIGATE Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote
CVE-2012-4025 MEDIUM 6.8 UPGRADE Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows r

References

← Back to latest CVEs