What is the CVSS score of CVE-2024-40635?

CVE-2024-40635 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Debian Linux are affected by CVE-2024-40635?

Organizations using containerd should be aware of moderate risk from CVE-2024-40635, a integer overflow vulnerability rated CVSS 4.6.. A patch is available.

How to fix or mitigate CVE-2024-40635?

Within 30 days: Identify affected systems running containerd and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Debian Linux CVE-2024-40635

MEDIUM

Integer Overflow or Wraparound (CWE-190)

2025-03-17 security-advisories@github.com

Buffer Overflow Integer Overflow Red Hat Debian Linux Suse Containerd

4.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:31 vuln.today

Patch released

Mar 28, 2026 - 18:31 nvd

Patch available

CVE Published

Mar 17, 2025 - 22:15 nvd

MEDIUM 4.6

DescriptionNVD

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

AnalysisAI

containerd is an open-source container runtime. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.

Technical ContextAI

This vulnerability is classified as Integer Overflow (CWE-190), which allows attackers to cause unexpected behavior through arithmetic overflow. containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Affected products include: Linuxfoundation Containerd, Debian Debian Linux.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate arithmetic operations, use safe integer libraries, check bounds before allocation.