CVE-2024-43598 LightGBM Remote Code Execution Vulnerability
Attackers can execute arbitrary code via memory corruption in the LightGBM machine learning library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43598?
CVE-2024-43598 is a high-severity memory corruption vulnerability in Microsoft LightGBM, published on 12 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LightGBM Remote Code Execution Vulnerability
Weakness: CWE-122
Which versions are affected by CVE-2024-43598?
3 open source packages ship an affected version, including lightgbm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lightgbm PyPI | All versions | 4.6.0 |
lightgbm PyPI | From 1.0.0 | 4.6.0 |
lightgbm PyPI | From 1.0.0 | 4.6.0 |
Products include Microsoft Lightgbm.
How do I fix CVE-2024-43598?
Upgrade lightgbm to 4.6.0 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-43598 being exploited?
There is no known exploitation of CVE-2024-43598 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1776904627, GHSA-2586-f3p4-hq84, PYSEC-2024-231.