CVE-2024-0645 is a high severity buffer overflow flaw in Explorer++, scored CVSS 7.3. The record lists Explorer++ version 1.3.5.531. The record names no fixed version. Use the steps below to confirm your exposure and plan the fix. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists Explorer++ version 1.3.5.531. It requires local access and a long filename argument.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, with a base score of 7.3 (High). KEV status: not listed in the record.
Fixed version: The record names no fixed version. Check the project release page for a newer build.
How to check if you're exposed
Check the installed version of the tool, for example under Help and About, or in your software inventory. Compare it with the version in the record. Because exploitation is local, prioritise shared workstations and build machines.
What to do now
- Find installs of the affected version.
- Move to a newer release if one exists, or stop using the tool on shared machines until one does.
- Avoid opening files or paths from sources you do not trust.
Why it matters
CWE-119 describes this class. Buffer overflow flaws arise when code writes more data than a memory region can hold. Here the record points to a long filename argument as the trigger. Bounds checking on every copy is the standard control.
CWE-120 describes this class. A classic buffer copy without checking the size of the input is the specific form noted here. Using length aware copy functions avoids it.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-17.
For a wider view, a free in-browser dependency scan and the Gold directory show where Explorer++ sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Local privilege and local code execution flaws are easy to underrate because they need a foothold first. In practice a foothold is often the second step of an intrusion, so these bugs decide how far an attacker can go after phishing or a stolen password. Treat them as part of defence in depth and patch them on a normal schedule, sooner on shared or high value hosts.
Quick check
Is CVE-2024-0645 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
How serious is a local only flaw?
It matters most on shared machines and where untrusted files or paths reach the tool.
Sources
- Safeguard Gold entry for CVE-2024-0645
- NVD record data for CVE-2024-0645, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
