Exploit for Out-of-bounds Write in Gnu Glibc CVE-2024-2961

Out-of-bounds write in Gnu Glibc iconv enables RCE.

Published 15 Oct 2026Updated 15 Oct 2026148 sources
CVSS 7.3 ✓ VERIFIED REFERENCE

What happened

Out-of-bounds write in Gnu Glibc iconv enables RCE.

Affected versions

Unknown product: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
SploitusOut-of-bounds write in Gnu Glibc iconv enables RCE.Sib11102026-10-16T01:20:13VerifiedPoC-in-GitHub · Sib1110/cve-2024-2961★ 0Sib11102026-10-16CandidatePoC-in-GitHub · mattaperkins/FIX-CVE-2024-2961Quick mitigation script★ 2mattaperkins2024-04-24CandidatePoC-in-GitHub · rvzsec/CVE-2024-2961CVE-2024–2961 Security Issue Mitigation Script★ 5rvzsec2024-05-20CandidatePoC-in-GitHub · ambionics/cnext-exploitsExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()★ 504ambionics2024-05-27CandidatePoC-in-GitHub · absolutedesignltd/iconvfixBash script to patch for CVE-2024-2961★ 0absolutedesignltd2024-05-30CandidatePoC-in-GitHub · exfil0/test_iconvThis repository contains a C program to test for CVE-2024-2961, a buffer overflow vulnerability in the iconv() function of glibc.★ 0exfil02024-06-03CandidatePoC-in-GitHub · tnishiox/cve-2024-2961★ 0tnishiox2024-06-04CandidatePoC-in-GitHub · kjdfklha/CVE-2024-2961_poc★ 2kjdfklha2024-06-04CandidatePoC-in-GitHub · kyotozx/CVE-2024-2961-Remote-File-ReadThis script demonstrates a proof-of-concept (PoC) for exploiting a file read vulnerability in the iconv library, as detailed in Ambionics Security's blog https://www.ambionics.io/blog/iconv-cve-2024-2961-p1.★ 5kyotozx2025-01-27CandidatePoC-in-GitHub · 4wayhandshake/CVE-2024-2961Uses CVE-2024-2961 to perform an arbitrary file read★ 04wayhandshake2025-01-29CandidatePoC-in-GitHub · omarelshopky/exploit_cve-2023-26326_using_cve-2024-2961Exploit for CVE-2023-26326 in the WordPress BuddyForms plugin, leveraging CVE-2024-2961 for remote code execution. This exploit bypasses PHP 8+ deserialization limitations by chaining vulnerabilities with php://filter.★ 1omarelshopky2025-02-02CandidatePoC-in-GitHub · suce0155/CVE-2024-2961CVE-2024-2961 Cnext RCE Exploit with Buddyforms 2.7.7★ 4suce01552025-02-04CandidatePoC-in-GitHub · Clarissss/osTicketFileReadIntoRCEFull-chain exploit combining PHP filter chain injection with CVE-2024-2961 (CNEXT) for unauthenticated Remote Code Execution on vulnerable osTicket installations.★ 0Clarissss2026-03-03CandidatePoC-in-GitHub · rcribelar-nucleus/my-cool-demo-php-codePHP RCE CVE-2024-2961 Nucleus Hackathon Demo★ 0rcribelar-nucleus2026-05-12CandidatePoC-in-GitHub · whyuhurtz/wongpressA WordPress demo lab for CVE-2024-2961 & CVE-2024-29510★ 0whyuhurtz2026-05-29CandidatePoC-in-GitHub · HORKimhab/CVE-2022-31626-CVE-2024-2961-CVE-2019-6977CVE-2022-31626, CVE-2024-2961, CVE-2019-6977, PHP security research★ 0HORKimhab2026-08-06CandidatePoC-in-GitHub · qinglove777/CVE-2024-2961-XXE-ExploitCVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel★ 0qinglove7772026-09-09Candidate