{"id":"CVE-2024-43688","details":"cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.","modified":"2026-08-12T15:13:07.369340Z","published":"2024-08-20T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43688.json","unresolved_ranges":[{"extracted_events":[{"fixed":"9cc8ab1"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43688.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43688"},{"type":"ADVISORY","url":"https://www.supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt"},{"type":"FIX","url":"https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vixie/cron","events":[{"introduced":"0"},{"fixed":"9cc8ab1087bb9ab861dd5595c41200683c9f6712"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43688.json","vanir_signatures_modified":"2026-08-12T15:13:07Z","vanir_signatures":[{"source":"https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712","target":{"file":"entry.c","function":"get_number"},"deprecated":false,"digest":{"function_hash":"63010936667497044806070309308377180632","length":976},"id":"CVE-2024-43688-02998527","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712","target":{"file":"entry.c"},"deprecated":false,"digest":{"line_hashes":["175567205010817314368500076822158778862","47778498664084520870679360908545878386","133239883662492912249389033162906519788","97738228706489242160427024682739810289","248027927010844222738730303263614546437","166179563446577277238884070354291796082","78381649272433403164334403893439064367","168782700858990039150069341528270165477"],"threshold":0.9},"id":"CVE-2024-43688-4423c8c0"},{"deprecated":false,"digest":{"function_hash":"82019581775357050425269310241462141255","length":470},"id":"CVE-2024-43688-8cf5c62d","signature_type":"Function","signature_version":"v1","source":"https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712","target":{"file":"entry.c","function":"set_range"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}