CVE-2024-3209 is a medium severity (CVSS 5.5) heap based buffer overflow in the get_ne64 function of UPX, the executable packer, in versions up to 4.2.2. The record names no upstream fix. Fedora announcements are listed, so check your distribution for an update.
What's affected
UPX up to and including 4.2.2. The affected function is get_ne64 in bele.h. The record says an exploit has been disclosed publicly and that the vendor was contacted early but did not respond. The record also lists Fedora 38 and 39 among affected platforms and links Fedora package announcements.
We did not review those announcements, so we cannot name a fixed package version. Check the Fedora advisory or your distribution tracker for the build that carries a fix, and check the upstream UPX releases.
The local attack vector and user interaction requirement explain the medium score: someone has to run UPX on a crafted file.
The weakness class: CWE-122, heap based buffer overflow. The NVD record scores it 5.5 (medium) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description calls the issue critical (VulDB wording), while the NVD score is 5.5, Medium.
How to check if you're exposed
Find UPX on build and analysis machines and in CI images.
upx --version
rpm -q upx
The second command applies to RPM based systems such as Fedora. On other systems use the package manager. Pay particular attention to CI runners and malware analysis boxes, which routinely run UPX on files from outside.
What to do now
- Locate UPX in developer machines, CI images and analysis tooling.
- Update through your distribution when a fixed package is available, and read its advisory.
- Do not unpack or pack untrusted files on machines that hold credentials.
- Run UPX inside a container or throwaway VM when handling samples.
Why it matters
A heap based buffer overflow, CWE-122, in a tool that parses executable formats means malformed input can corrupt memory. Parsers of complex binary formats are a long standing source of this class.
UPX is mostly a build or analysis tool, so the exposure is narrower than for a network service. It still tends to run on machines with secrets, which is why CI images deserve a look.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a build tool vulnerability worth patching?
Yes if it processes files from outside your control. Build and analysis machines often hold signing keys and tokens, so a memory corruption bug in a tool they run can matter even though the tool is not a service.
Sources
- References in the NVD record (not individually reviewed): Fedora package announcements and VulDB entry 259055
- Safeguard Gold entry for CVE-2024-3209
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
