What happened
Out-of-bounds write in Gnu Glibc iconv enables RCE.
Affected versions
Unknown product: See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusOut-of-bounds write in Gnu Glibc iconv enables RCE.Sib11102026-10-16T01:20:13VerifiedPoC-in-GitHub · Sib1110/cve-2024-2961★ 0Sib11102026-10-16CandidatePoC-in-GitHub · mattaperkins/FIX-CVE-2024-2961Quick mitigation script★ 2mattaperkins2024-04-24CandidatePoC-in-GitHub · rvzsec/CVE-2024-2961CVE-2024–2961 Security Issue Mitigation Script★ 5rvzsec2024-05-20CandidatePoC-in-GitHub · ambionics/cnext-exploitsExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()★ 504ambionics2024-05-27CandidatePoC-in-GitHub · absolutedesignltd/iconvfixBash script to patch for CVE-2024-2961★ 0absolutedesignltd2024-05-30CandidatePoC-in-GitHub · exfil0/test_iconvThis repository contains a C program to test for CVE-2024-2961, a buffer overflow vulnerability in the iconv() function of glibc.★ 0exfil02024-06-03CandidatePoC-in-GitHub · tnishiox/cve-2024-2961★ 0tnishiox2024-06-04CandidatePoC-in-GitHub · kjdfklha/CVE-2024-2961_poc★ 2kjdfklha2024-06-04CandidatePoC-in-GitHub · kyotozx/CVE-2024-2961-Remote-File-ReadThis script demonstrates a proof-of-concept (PoC) for exploiting a file read vulnerability in the iconv library, as detailed in Ambionics Security's blog https://www.ambionics.io/blog/iconv-cve-2024-2961-p1.★ 5kyotozx2025-01-27CandidatePoC-in-GitHub · 4wayhandshake/CVE-2024-2961Uses CVE-2024-2961 to perform an arbitrary file read★ 04wayhandshake2025-01-29CandidatePoC-in-GitHub · omarelshopky/exploit_cve-2023-26326_using_cve-2024-2961Exploit for CVE-2023-26326 in the WordPress BuddyForms plugin, leveraging CVE-2024-2961 for remote code execution. This exploit bypasses PHP 8+ deserialization limitations by chaining vulnerabilities with php://filter.★ 1omarelshopky2025-02-02CandidatePoC-in-GitHub · suce0155/CVE-2024-2961CVE-2024-2961 Cnext RCE Exploit with Buddyforms 2.7.7★ 4suce01552025-02-04CandidatePoC-in-GitHub · Clarissss/osTicketFileReadIntoRCEFull-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.★ 0Clarissss2026-03-03CandidatePoC-in-GitHub · rcribelar-nucleus/my-cool-demo-php-codePHP RCE CVE-2024-2961 Nucleus Hackathon Demo★ 0rcribelar-nucleus2026-05-12CandidatePoC-in-GitHub · whyuhurtz/wongpressA WordPress demo lab for CVE-2024-2961 & CVE-2024-29510★ 0whyuhurtz2026-05-29CandidatePoC-in-GitHub · HORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977CVE-2022-31626, CVE-2024-2961, CVE-2019-6977, PHP security research★ 0HORKimhab2026-08-06CandidatePoC-in-GitHub · qinglove777/CVE-2024-2961-XXE-ExploitCVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel★ 0qinglove7772026-09-09CandidateSource timeline
Discovered through SploitusView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.