CVE-2019-18224 Memory corruption in n/a

Critical 9.8 Published 21 Oct 2019 Updated 14 Oct 2026

A heap-based buffer overflow in GNU libidn2 allows attackers to execute arbitrary code or cause denial of service via a long domain string.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-18224?

CVE-2019-18224 is a critical memory corruption vulnerability in n/a, published on 21 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

Weakness: CWE-787

Which versions are affected by CVE-2019-18224?

It affects 1 product.

Linux distribution packages (15)

`idn2` AlmaLinux:8	All versions	`2.2.0-1.el8`
`libidn2` AlmaLinux:8	All versions	`2.2.0-1.el8`
`libidn2-devel` AlmaLinux:8	All versions	`2.2.0-1.el8`
`idn2` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.0-1.el8`
`idn2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.0-1.el8`
`libidn2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.0-1.el8`
`libidn2-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.2.0-1.el8`
`idn2-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.2.0-1.el8`
`libidn2` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.2.0-1.el8`
`libidn2-debuginfo` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.2.0-1.el8`
`libidn2-debugsource` Red Hat:enterprise_linux:8::baseos	All versions	`0:2.2.0-1.el8`
`idn2-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:2.2.0-1.el8`
`libidn2-debuginfo` Red Hat:enterprise_linux:8::crb	All versions	`0:2.2.0-1.el8`
`libidn2-debugsource` Red Hat:enterprise_linux:8::crb	All versions	`0:2.2.0-1.el8`
`libidn2-devel` Red Hat:enterprise_linux:8::crb	All versions	`0:2.2.0-1.el8`

Products include Gnu Libidn2.

How do I fix CVE-2019-18224?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-18224 being exploited?

There is no known exploitation of CVE-2019-18224 in the wild and no public exploit code.

Sources

Also known as ALBA-2019:3621, ALPINE-CVE-2019-18224, CLEANSTART-2024-VX77330, DEBIAN-CVE-2019-18224, DSA-4613-1, GHSA-j2c9-63g7-697x and 2 more.