VULNERABILITY INTELLIGENCE

CVE-2024-32487

CVSS score8.6 HIGH
EPSS probability0.63%
CISA KEVNot currently listed
Published2024-04-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-96

Primary references