HSEC-2024-0007 Sign extension error in the AArch64 NCG
A sign extension error in the AArch64 backend of the GHC compiler can cause incorrect results, potentially leading to buffer overflows and code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is HSEC-2024-0007?
HSEC-2024-0007 is a vulnerability in ghc, published on 14 Nov 2025.
Official description
Sign extension error in the AArch64 NCG
Arithmetic operations may result in incorrect runtime results on the native aarch64 backend. For the most part, this bug only causes availability and data integrity issues. However, in some circumstances, it may result in other, more complicated security related flaws, such as buffer overflow conditions.
Which versions are affected by HSEC-2024-0007?
1 open source package ship an affected version, including ghc.
| Package | Affected | Fixed in |
|---|---|---|
ghc GHC | From 9.2.4 | 9.2.5, 9.4.3 |
How do I fix HSEC-2024-0007?
Upgrade ghc to a fixed version for your release line: 9.2.5 or 9.4.3.
Is HSEC-2024-0007 being exploited?
There is no known exploitation of HSEC-2024-0007 in the wild and no public exploit code.