CVE-2024-47611 | XZ Utils on Microsoft Windows platform are vulnerable to argument injection

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. This vulnerability is fixed in 5.6.3. Command line tools built for Cygwin or MSYS2 are unaffected. liblzma is unaffected.

Published: 2024-10-02 Last update: 2026-04-15 Assigner: [email protected] Source: [email protected]
NVD Status：Deferred，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2024-47611 is rated Moderate Risk (46.1/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.39%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2024-47611

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-21 0.29% 0.39% +0.10%
2 2025-11-21 0.54% 0.29% -0.26%
3 2025-11-18 — 0.54% —

Full EPSS history (10 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2024-47611

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.3 4.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:P)
Additional preconditions must be present for exploitation.
Privileges required (PR:N)
No privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:L)
Limited confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:L)
Limited integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:L)
Limited availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:N)
No availability impact on subsequent systems.
Exploit maturity (threat) (E:X)
Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked).
Confidentiality requirement (CR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Integrity requirement (IR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Availability requirement (AR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Modified attack vector (MAV:X)
Not defined: scoring uses the Base Attack Vector (AV).
Modified attack complexity (MAC:X)
Not defined: scoring uses the Base Attack Complexity (AC).
Modified attack requirements (MAT:X)
Not defined: scoring uses the Base Attack Requirements (AT).
Modified privileges required (MPR:X)
Not defined: scoring uses the Base Privileges Required (PR).
Modified user interaction (MUI:X)
Not defined: scoring uses the Base User Interaction (UI).
Modified vulnerable system confidentiality impact (MVC:X)
Not defined: scoring uses the Base VC metric.
Modified vulnerable system integrity impact (MVI:X)
Not defined: scoring uses the Base VI metric.
Modified vulnerable system availability impact (MVA:X)
Not defined: scoring uses the Base VA metric.
Modified subsequent system confidentiality impact (MSC:X)
Not defined: scoring uses the Base SC metric.
Modified subsequent system integrity impact (MSI:X)
Not defined: scoring uses the Base SI metric.
Modified subsequent system availability impact (MSA:X)
Not defined: scoring uses the Base SA metric.
Safety (supplemental) (S:X)
Not evaluated.
Automatable (supplemental) (AU:X)
Not evaluated.
Recovery (supplemental) (R:X)
Not evaluated.
Value density (supplemental) (V:X)
Not evaluated.
Vulnerability response effort (supplemental) (RE:X)
Not evaluated.
Provider urgency (supplemental) (U:X)
Not evaluated.
 — — [email protected]

Weakness enumeration for CVE-2024-47611

OS Trackers for CVE-2024-47611

vendor priority summary link
alpine medium CVE-2024-47611: 1 source package rows (xz); 18 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 0, open 18. https://security.alpinelinux.org/vuln/CVE-2024-47611
debian unimportant CVE-2024-47611 unimportant priority: Debian including 1 source packages (xz-utils), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2024-47611
redhat medium — https://access.redhat.com/security/cve/CVE-2024-47611
suse medium CVE-2024-47611 severity moderate: SUSE including 7 source package names (liblzma5, liblzma5-32bit, …), 148 product×package rows across 35 product lines (SUSE Linux Enterprise High Performance Computing 12 SP5, SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS, … (35 product lines)): Known Not Affected 148. https://www.suse.com/security/cve/CVE-2024-47611/
ubuntu medium CVE-2024-47611 medium priority: Ubuntu including 1 source packages (xz-utils), 7 status rows across 7 suites (bionic, focal, jammy, noble, trusty, upstream, xenial): not-affected 6, needs-triage 1. https://ubuntu.com/security/CVE-2024-47611

Affected software / configurations for CVE-2024-47611

Vendor Product Version Raw CPE
No affected products in dataset.

References for CVE-2024-47611

cvelogic Threat Intelligence