CVE-2020-24240

Name: CVE-2020-24240
Creator: NVD / NIST
Published: 2020-08-25T14:15:16.543+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.5/10EPSS 1.26%

Last modified Jun 17, 2026

CVE-2020-24240 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. EPSS estimates a 1.26% chance of exploitation in the next 30 days.

Description

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

Metrics

CVSS 3.1

5.5/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Probability

1.26%

66.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-416

Affected Software

Vendor	Product	Versions
Gnu	Bison	3.7

References

https://github.com/akimd/bison/commit/be95a4fe2951374676efc9454ffee8638faaf68dPatch, Third Party Advisory
https://github.com/akimd/bison/compare/v3.7...v3.7.1Third Party Advisory
https://lists.gnu.org/r/bug-bison/2020-07/msg00051.htmlMailing List, Vendor Advisory
https://github.com/akimd/bison/commit/be95a4fe2951374676efc9454ffee8638faaf68dPatch, Third Party Advisory
https://github.com/akimd/bison/compare/v3.7...v3.7.1Third Party Advisory
https://lists.gnu.org/r/bug-bison/2020-07/msg00051.htmlMailing List, Vendor Advisory

Timeline

Published: Aug 25, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-24240?

How severe is CVE-2020-24240?

CVE-2020-24240 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 1.26% probability of exploitation in the next 30 days.

How do I fix CVE-2020-24240?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-24240?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST