PT-2024-36814 · Openfhe · Openfhe

Published 2024-12-25 · Updated 2025-04-26 · CVE-2024-56430

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenFHE versions 1.2.3 and earlier

Description The issue is related to a NULL pointer dereference in the BinFHEContext::EvalFloor function located in lib/binfhe-base-scheme.cpp. This problem can lead to a crash or potentially allow an attacker to execute arbitrary code. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For OpenFHE versions 1.2.3 and earlier, as a temporary workaround, consider disabling the BinFHEContext::EvalFloor function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2024-56430

Affected Products

Openfhe

References · 11

• 🔥 https://github.com/UnionTech-Software/openfhe-PoC · Exploit
• https://osv.dev/vulnerability/CVE-2024-56430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56430 · Security Note
• https://github.com/openfheorg/openfhe-development/blob/7b8346f4eac27121543e36c17237b919e03ec058/src/binfhe/lib/binfhe-base-scheme.cpp#L307-L308 · Note
• https://github.com/openfheorg/openfhe-development/releases/tag/v1.2.3 · Note
• https://t.me/cvenotify/119911 · Telegram Post
• https://t.me/cvenotify/105451 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1871990182779449798 · Twitter Post
• http://openwall.com/lists/oss-security/2025/04/25/3 · Note
• https://t.me/cvedetector/13635 · Telegram Post
• https://twitter.com/CVEnew/status/1871971818736689425 · Twitter Post