CVE-2024-45064 is a high severity (CVSS 8.5) buffer overflow in the FileX Internal RAM interface of STMicroelectronics X-CUBE-AZRTOS packages. Cisco Talos reports that crafted network packets can lead to code execution. The NVD record names no fixed version, so check the STMicroelectronics and Talos advisories and rebuild your firmware from an updated package.
What's affected
The NVD description names STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. The record also lists a family of related ST packages as affected products: x-cube-azrt-h7rs, and x-cube-azrtos-f4, f7, g0, g4, h7, l4 and l5.
This is embedded firmware code, not a library you pull from a package registry. Whether a given device is exposed depends on whether its firmware was built with the vulnerable FileX component and whether the affected interface is reachable over a network.
The record does not list a fixed version. Do not assume a newer package number is safe until the vendor says so.
How to check if you're exposed
Start with your firmware bill of materials. Search your build tree and vendored sources for the X-CUBE-AZRTOS package names above, and note which package version each product line was built from.
grep -ril "x-cube-azrtos" . --include="*.xml" --include="*.ioc" --include="*.txt" --include="*.json"
Then read the Talos report referenced in the record (TALOS-2024-2096) and the matching STMicroelectronics notice to confirm which package versions are affected and which release carries the fix. If a device ships to customers, confirm with the hardware owner whether the FileX RAM interface is enabled and whether the device accepts network traffic that reaches it.
What to do now
- List every product and board support package built from an X-CUBE-AZRTOS package and record the package version.
- Open the Talos report and the STMicroelectronics advisory and note the fixed release for your package family.
- Update the package in your project, regenerate the code, and rebuild the firmware.
- Test the new image on a bench device before scheduling a field update.
- If you cannot update soon, limit which networks can reach the device and keep it off untrusted segments.
Why it matters
This is a CWE-119 (Buffer Overflow) problem, the classic case where code writes more data into a buffer than it was sized to hold. In firmware that usually means neighbouring memory is overwritten, and with careful input an attacker can turn that into control of execution. Talos describes a sequence of requests as the trigger.
The CVSS vector reads network reachable, high attack complexity, low privileges, with changed scope and high impact on confidentiality, integrity and availability. High complexity helps, but the changed scope matters on devices where the firmware sits next to other functions. The record does not mark this as exploited in the wild and it is not on the CISA KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-45064.
Quick check
Is CVE-2024-45064 exploited in the wild?
The NVD record does not flag it as a CISA Known Exploited Vulnerability, and nothing in the record says it has been exploited.
Can a dependency scanner find this?
Only if the package appears in a manifest or bill of materials. Embedded packages vendored into a firmware tree often do not, so a manual search of the build tree is the safer first step.
Sources
Last reviewed: 19 October 2026.
