CVE-2024-42415: Gnome Libgsf Integer Overflow RCE Vulnerability

CVE-2024-42415 Overview

CVE-2024-42415 is an integer overflow vulnerability [CWE-190] in the Compound Document Binary File (CDBF) format parser of the GNOME Project G Structured File Library (libgsf) version 1.14.52. A specially crafted file triggers an integer overflow during processing of the sector allocation table. This overflow leads to a heap-based buffer overflow that can result in arbitrary code execution. An attacker delivers a malicious document to a user, who must open it to trigger the flaw. Because libgsf is used by GNOME applications and downstream projects that parse Microsoft Office legacy formats, the exposure extends across desktop Linux distributions.

Critical Impact
Opening a malicious Compound Document Binary File can result in arbitrary code execution in the context of the user running an application that links against libgsf 1.14.52.

Affected Products

GNOME libgsf 1.14.52
Downstream distributions packaging the vulnerable release, including Debian LTS
GNOME desktop applications and third-party tooling that parse CDBF via libgsf

Discovery Timeline

2024-10-03 - CVE-2024-42415 published to the National Vulnerability Database (NVD)
2024-10-04 - Coordinated disclosure via the OpenWall OSS-Security mailing list
2024-10 - Debian LTS security update released
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-42415

Vulnerability Analysis

The flaw sits in the CDBF parser inside libgsf, the library GNOME applications use to read structured storage files such as legacy .doc, .xls, and .ppt documents. The parser reads sector allocation metadata from the input file and uses attacker-controlled values in arithmetic that determines heap allocation sizes. When those values are crafted to overflow an integer during size calculation, the parser allocates a buffer smaller than the data it will subsequently write. The resulting heap-based buffer overflow corrupts adjacent heap metadata and objects, providing the primitive needed for arbitrary code execution in the parsing process.

Exploitation requires local delivery of the file and user interaction to open it, but no privileges on the target system. Successful exploitation yields code execution at the privilege level of the parsing application, which for desktop users typically means the interactive session.

Root Cause

The root cause is missing validation of size fields read from the sector allocation table of the Compound Document Binary File. The parser performs multiplication or addition on attacker-controlled 32-bit values without bounds or overflow checks, then passes the truncated result to a heap allocator. Refer to GNOME libgsf Issue #34 and the Talos Intelligence report TALOS-2024-2069 for the affected parsing paths.

Attack Vector

An attacker crafts a malicious CDBF document and delivers it via email, chat, download, or removable media. When the victim opens the file with an application that uses libgsf 1.14.52, the parser processes the malformed sector allocation table, triggering the overflow. The attack requires user interaction and executes locally, but no authentication is needed on the target.

No verified public proof-of-concept code is available for CVE-2024-42415.
See TALOS-2024-2069 and GNOME libgsf issue #34 for technical details
on the vulnerable sector allocation table parsing path.

Detection Methods for CVE-2024-42415

Indicators of Compromise

Unexpected crashes of GNOME applications or command-line tools linked against libgsf immediately after opening a Compound Document Binary File
Child processes spawned by document-parsing applications that do not match legitimate rendering behavior
Outbound network connections from a document-parsing process shortly after a CDBF file is opened
Presence of the vulnerable libgsf 1.14.52 binaries on hosts based on package inventory

Detection Strategies

Inventory installed packages and flag hosts running libgsf 1.14.52 or unpatched downstream builds
Alert on GNOME or document-viewer processes spawning shells, interpreters, or writing to autostart locations
Monitor for CDBF files delivered through email gateways or web proxies and correlate with subsequent process anomalies
Enable core dump collection on desktop fleets and triage crashes originating in libgsf symbols

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a central data lake for cross-host correlation
Track parent-child process relationships for applications that parse Office legacy formats
Collect package management events to detect installation or rollback of vulnerable libgsf versions
Build a watchlist for user reports of application crashes when opening attachments and correlate with EDR telemetry

How to Mitigate CVE-2024-42415

Immediate Actions Required

Upgrade libgsf to the version shipped by your distribution that fixes CVE-2024-42415, following the Debian LTS advisory or your vendor's equivalent
Restart or reinstall any application that dynamically links libgsf after patching to ensure the vulnerable library is unloaded
Restrict handling of untrusted Compound Document Binary files, especially from email and external sources, until patching is complete
Audit the fleet for hosts still running libgsf 1.14.52 and prioritize desktop and multi-user systems

Patch Information

Upstream tracks the fix in GNOME libgsf Issue #34. Debian LTS shipped updated packages via the October 2024 security announcement. Additional distribution-specific fixes are referenced in the Talos Intelligence report. Apply the vendor-supplied update rather than building from source unless required.

Workarounds

Block or quarantine legacy Microsoft Office binary formats at the email gateway when business needs allow
Open untrusted CDBF documents in a sandboxed environment or disposable virtual machine until patches are deployed
Remove or disable applications that link against libgsf on servers where document parsing is not required

bash

# Verify the installed libgsf version on Debian/Ubuntu systems
dpkg -l | grep libgsf
apt-cache policy libgsf-1-114

# Upgrade to the patched package
sudo apt update
sudo apt install --only-upgrade libgsf-1-114

# On RPM-based systems
rpm -qa | grep libgsf
sudo dnf upgrade libgsf