Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-fj7w-564m-yuca
Vulnerability ID VCID-fj7w-564m-yuca
Aliases CVE-2024-24792
GHSA-9phm-fm57-rhg8
Summary Panic when parsing invalid palette-color images in golang.org/x/image Parsing a corrupt or malicious image with invalid color indices can cause a panic.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-248 Uncaught Exception
CWE-125 Out-of-bounds Read
System Score Found at
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-24792
cvssv3.1 7.5 https://cs.opensource.google/go/x/image
cvssv4 8.7 https://cs.opensource.google/go/x/image
generic_textual HIGH https://cs.opensource.google/go/x/image
cvssv3.1 7.5 https://go.dev/cl/588115
cvssv4 8.7 https://go.dev/cl/588115
generic_textual HIGH https://go.dev/cl/588115
ssvc Track https://go.dev/cl/588115
cvssv3.1 7.5 https://go.dev/issue/67624
cvssv4 8.7 https://go.dev/issue/67624
generic_textual HIGH https://go.dev/issue/67624
ssvc Track https://go.dev/issue/67624
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-24792
cvssv4 8.7 https://nvd.nist.gov/vuln/detail/CVE-2024-24792
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-24792
cvssv3.1 7.5 https://pkg.go.dev/vuln/GO-2024-2937
cvssv4 8.7 https://pkg.go.dev/vuln/GO-2024-2937
generic_textual HIGH https://pkg.go.dev/vuln/GO-2024-2937
ssvc Track https://pkg.go.dev/vuln/GO-2024-2937
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-24792
https://cs.opensource.google/go/x/image
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24792
https://go.dev/cl/588115
https://go.dev/issue/67624
https://nvd.nist.gov/vuln/detail/CVE-2024-24792
https://pkg.go.dev/vuln/GO-2024-2937
1074426 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074426
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://cs.opensource.google/go/x/image
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://cs.opensource.google/go/x/image
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/cl/588115
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://go.dev/cl/588115
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-17T15:53:18Z/ Found at https://go.dev/cl/588115
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://go.dev/issue/67624
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://go.dev/issue/67624
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-17T15:53:18Z/ Found at https://go.dev/issue/67624
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-24792
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-24792
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://pkg.go.dev/vuln/GO-2024-2937
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Found at https://pkg.go.dev/vuln/GO-2024-2937
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-17T15:53:18Z/ Found at https://pkg.go.dev/vuln/GO-2024-2937
Exploit Prediction Scoring System (EPSS)
Percentile 0.37177
EPSS Score 0.00162
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:51:46.731911+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-9phm-fm57-rhg8/GHSA-9phm-fm57-rhg8.json 38.0.0