CVE-2023-32724 JavaScript engine memory pointers are directly available for Zabbix users for modification

Critical 9.1 Published 12 Oct 2023 Updated 3 Nov 2025

Attackers can manipulate exposed JavaScript engine memory pointers in Zabbix to achieve arbitrary code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-32724?

CVE-2023-32724 is a critical memory corruption vulnerability in Zabbix Zabbix, published on 12 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.

Weakness: CWE-732

Which versions are affected by CVE-2023-32724?

It affects 1 product.

Products include Zabbix Zabbix.

How do I fix CVE-2023-32724?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-32724 being exploited?

There is no known exploitation of CVE-2023-32724 in the wild and no public exploit code.

All Zabbix Zabbix vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-32724, GHSA-w5wv-98xr-mhmx, UBUNTU-CVE-2023-32724.