CVE-2024-58392 Details
Description
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.
A memory safety vulnerability allowing out-of-bounds read has been identified in PhysicsFS versions through 3.2.0. The issue arises in the UTF-8 decoding function __PHYSFS_utf8codepoint(), where the cursor incorrectly advances past the end of name buffers. This flaw can be exploited by supplying a crafted archive with entry names that include six-octet UTF-8 sequences. The exploitation causes the application to read beyond the intended buffer limits, leading to a crash. The vulnerability was confirmed through source code review and dynamic analysis with AddressSanitizer, which revealed a heap-buffer-overflow on the lookup path and a stack-buffer-overflow during the insertion of names into the directory tree.
Users are advised to update to the patched version of PhysicsFS, which is available on the official GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/icculus/physfs/blob/release-3.2.0/src/physfs_unicode.c#L165-L187 | [email protected] | Source CodeVendor |
| https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5 | [email protected] | Source CodeVendor |
| https://github.com/icculus/physfs/issues/79 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://hackmd.io/@haind-pwn/physfs-utf8-decoder-overread | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/physicsfs-through-3.2.0-out-of-bounds-read-via-physfs-utf8codepoint | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PhysicsFS | <= 3.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |