First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-27528

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
wasm3_project	wasm3	139076a98b8321b67f850a844f558b5e91b5ac83

References

https://gist.github.com/haruki3hhh/baa757c4af4fefb410d9c74d7a68152eThird Party Advisory
https://github.com/wasm3/wasm3/issues/463Exploit, Issue Tracking

Timeline

Published: Nov 8, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-275298.4wasm3 139076a contains memory leaks in Read_utf8.CVE-2024-27534.8Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen CVE-2024-275308.4wasm3 139076a contains a Use-After-Free in ForEachModule.CVE-2024-275327.5wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_res CVE-2024-27548.8A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the CVE-2024-275586.1Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.CVE-2024-275596.3Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php CVE-2024-27566.5Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a st CVE-2024-275618.1A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the applic CVE-2024-275635.3A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make a CVE-2024-275646.5pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived CVE-2024-275659.8A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to ma