Read the docs
TI-2024-39136 Aliases CVE-2024-58392GHSA-f7r8-2vph-g5gv

Out-of-bounds read in PhysicsFS UTF-8 codepoint handling

Priority LOW 21CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

PhysicsFS through 3.2.0 is affected. The __PHYSFS_utf8codepoint() function advances its cursor one octet too far on six-octet UTF-8 sequences, so it reads past name buffers (CWE-125). An attacker who supplies a crafted archive with entry names ending in such sequences causes PHYSFS_utf8stricmp() and hashing to over-read and crash the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
icculusPhysicsFSup to 3.2.0—No fix listedCNA
  • PhysicsFS Vendoricculus Affected up to 3.2.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for PhysicsFS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2024-58392
  2. 2026-10-14 Alias added: GHSA-f7r8-2vph-g5gv
  3. 2026-10-16 Affected versions changed · Red Hat
  4. 2026-10-16 CVSS score added · Red Hat
  5. 2026-10-20 CISA SSVC decision points changed

References

Patch 1

Advisory 1

Other 2

  • TI-2026-76161 Heap out-of-bounds read in smpeg MPEG stream parsing CVSS 4.0MEDIUM 6.8
  • TI-2009-03473 Stack-based buffer overflow in the M_AddToServerList function in client/menu.c in Red… CVSS 2.0HIGH 10.0
  • TI-2026-76162 Integer underflow in smpeg MPEG parser can crash applications CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences