CVE-2024-0325 is a low severity (CVSS 3.6) local command injection weakness in Perforce Helix Sync. The record places the fix in version 2024.1. It is not listed as exploited in the wild by CISA. Check your own installs against the affected range below.
What's affected
Helix Sync from Perforce, in versions prior to 2024.1. The description says a local command injection was identified and credits the report to Bryan Riggins.
The weakness is mapped to CWE-94, code injection, and CWE-77, command injection. The record was published on 2024-02-01. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Open the Helix Sync client and read its version from the About information, or check the installer you deployed. Any version before 2024.1 is in scope. Add the client to your inventory if it is missing.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of Perforce Helix Sync in your environment, including test systems and anything bought or installed by a team outside IT.
- Update Helix Sync to 2024.1 or later.
- Limit who has interactive access to machines that run the client.
- Update to 2024.1 or later across developer workstations and build agents.
- Include the client in your software inventory so it shows up in future checks.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
A local command injection needs access to the machine already. That is why the score is low. It still matters on shared workstations and build machines, where a user with limited rights might use it to run commands in the context of the tool.
The fix shipped in release 2024.1, according to the record. The record is brief, so use the vendor release notes for details.
The CVSS vector reads as follows. The attack is possible with local access, attack complexity is high, privileges required are low, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, limited and no respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. Check the vendor advisory for current status.
Which versions are fixed?
The record places the fix in version 2024.1.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
