CVE-2024-42011 - Vulnerability Details - OpenCVE

The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00213.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Spotify	Spotify App

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://community.spotify.com/t5/iOS-iPhone-iPad/Spotify-constantly-crashes-lags-and-heats-up-my-battery/td-p/6217537
https://luminous-reminder-337.notion.site/Buffer-Overflow-Vulnerability-in-Spotify-iOS-App-Steps-to-Reproduce-By-0xRushy-5114aa2548e2401eb6812a12af888b8c

History

Mon, 14 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00133}`	epss `{'score': 0.0015}`

Wed, 30 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spotify Spotify spotify App
Weaknesses		CWE-120
CPEs		cpe:2.3:a:spotify:spotify_app::::::::
Vendors & Products		Spotify Spotify spotify App
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 28 Oct 2024 20:30:00 +0000

Type	Values Removed	Values Added
Description		The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.
References		https://community.spotify.com/t5/iOS-iPhone-iPad/Spotify-constantly-crashes-lags-and-heats-up-my-battery/td-p/6217537 https://luminous-reminder-337.notion.site/Buffer-Overflow-Vulnerability-in-Spotify-iOS-App-Steps-to-Reproduce-By-0xRushy-5114aa2548e2401eb6812a12af888b8c

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-10-28T00:00:00

Updated: 2024-10-30T17:34:33.888Z

Reserved: 2024-07-26T00:00:00

Link: CVE-2024-42011

Vulnrichment

Updated: 2024-10-30T17:34:29.181Z

NVD

Status : Undergoing Analysis

Published: 2024-10-28T21:15:05.043

Modified: 2024-10-30T18:35:10.283

Link: CVE-2024-42011

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-42011", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-30T17:34:33.888Z", "dateReserved": "2024-07-26T00:00:00", "datePublished": "2024-10-28T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-28T20:23:33.565422"}, "descriptions": [{"lang": "en", "value": "The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://luminous-reminder-337.notion.site/Buffer-Overflow-Vulnerability-in-Spotify-iOS-App-Steps-to-Reproduce-By-0xRushy-5114aa2548e2401eb6812a12af888b8c"}, {"url": "https://community.spotify.com/t5/iOS-iPhone-iPad/Spotify-constantly-crashes-lags-and-heats-up-my-battery/td-p/6217537"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "affected": [{"vendor": "spotify", "product": "spotify_app", "cpes": ["cpe:2.3:a:spotify:spotify_app:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "8.9.58", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-30T17:25:36.375570Z", "id": "CVE-2024-42011", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-30T17:34:33.888Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-42011", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-30T17:25:36.375570Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:spotify:spotify_app:*:*:*:*:*:*:*:*"], "vendor": "spotify", "product": "spotify_app", "versions": [{"status": "affected", "version": "8.9.58"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-30T17:34:29.181Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://luminous-reminder-337.notion.site/Buffer-Overflow-Vulnerability-in-Spotify-iOS-App-Steps-to-Reproduce-By-0xRushy-5114aa2548e2401eb6812a12af888b8c"}, {"url": "https://community.spotify.com/t5/iOS-iPhone-iPad/Spotify-constantly-crashes-lags-and-heats-up-my-battery/td-p/6217537"}], "descriptions": [{"lang": "en", "value": "The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-28T20:23:33.565422"}}}, "cveMetadata": {"cveId": "CVE-2024-42011", "state": "PUBLISHED", "dateUpdated": "2024-10-30T17:34:33.888Z", "dateReserved": "2024-07-26T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-10-28T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}