CVE-2024-36600 Overview
CVE-2024-36600 is a stack-based buffer overflow [CWE-121] in GNU libcdio version 2.2.0, a library used to read and control CD-ROM and ISO 9660 filesystem images. An attacker can execute arbitrary code by supplying a crafted ISO 9660 image file to an application that links against the vulnerable library. The flaw is fixed in libcdio 2.3.0.
Because libcdio ships with many Linux distributions and multimedia tools, the vulnerability affects any workflow that parses untrusted disc images, including forensic utilities, media players, and archival tooling.
Critical Impact
A crafted ISO 9660 image can trigger arbitrary code execution in the context of the process parsing the image, compromising confidentiality, integrity, and availability on the local host.
Affected Products
- GNU libcdio 2.2.0
- Applications and Linux distributions bundling libcdio 2.2.0
- Downstream tools that link libcdio for ISO 9660 parsing
Discovery Timeline
- 2024-06-14 - CVE-2024-36600 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-36600
Vulnerability Analysis
The vulnerability is a stack-based buffer overflow [CWE-121] in libcdio's ISO 9660 parsing code. When the library processes a maliciously crafted ISO 9660 image, it writes attacker-controlled data past the bounds of a fixed-size stack buffer. This overwrite corrupts adjacent stack memory, including saved return addresses and frame pointers, enabling control-flow hijacking.
Exploitation requires local delivery of the crafted image to a process using libcdio. Successful exploitation yields arbitrary code execution with the privileges of the parsing process. Because the attack requires no authentication or user interaction beyond opening the image, any automated ingestion path (indexers, thumbnailers, backup scanners) increases exposure.
The fix landed in libcdio 2.3.0. Discussion and remediation are tracked in libcdio Pull Request #32, libcdio Pull Request #46, and Red Hat Bugzilla #2292833.
Root Cause
The root cause is missing or insufficient bounds checking when copying fields from an ISO 9660 image structure into a fixed-size stack buffer. The parser trusts length or offset values embedded in the image without validating them against the destination buffer size, allowing an oversized field to overflow the stack.
Attack Vector
The attack vector is local. An attacker crafts an ISO 9660 image containing malformed metadata, then delivers it to a target user or automated process. When the image is parsed by any tool linked against vulnerable libcdio, the overflow triggers. Consult the GitHub CVE-2024-36600 reports for reproducer details.
Detection Methods for CVE-2024-36600
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes linking libcdio (for example, iso-info, iso-read, media players) when opening ISO files
- Child processes spawned by ISO parsing utilities that would not normally fork shells or network clients
- ISO 9660 files with malformed directory records, oversized filename fields, or inconsistent length descriptors
Detection Strategies
- Inventory hosts and containers running libcdio and identify versions at or below 2.2.0 using package managers (rpm -q libcdio, dpkg -l libcdio)
- Enable core dump collection on ISO parsing utilities and review crash signatures for stack corruption indicators
- Apply file-integrity monitoring on directories where untrusted ISO images are staged for processing
Monitoring Recommendations
- Log invocations of ISO parsing binaries and correlate with the source of the input file
- Alert on anomalous process ancestry where libcdio-linked tools spawn shells, interpreters, or outbound network connections
- Track patch state of libcdio across the fleet and flag hosts still exposing version 2.2.0
How to Mitigate CVE-2024-36600
Immediate Actions Required
- Upgrade libcdio to version 2.3.0 or later on all systems and rebuild statically linked consumers
- Apply distribution security updates addressing CVE-2024-36600 as they become available
- Restrict processing of ISO 9660 images from untrusted sources until patching is complete
Patch Information
The upstream fix is available in libcdio 2.3.0. Review the merged changes in libcdio Pull Request #32 and libcdio Pull Request #46. Distribution-specific backports are tracked through vendor advisories including Red Hat Bugzilla #2292833.
Workarounds
- Disable automated ISO ingestion in file indexers, thumbnailers, and backup scanners on unpatched hosts
- Run ISO parsing utilities inside sandboxes or restricted containers with seccomp and reduced filesystem access
- Validate ISO images with independent tooling before feeding them into libcdio-based workflows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
