CVE-2026-24875
Published: 27 January 2026
Summary
CVE-2026-24875 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-24875 is an integer overflow or wraparound vulnerability (CWE-190) in the modizer software developed by yoyofr. It affects modizer versions prior to 4.1.1. The vulnerability was published on 2026-01-27 and carries a CVSS v3.1 base score of 7.8, indicating high severity due to its potential for significant impact.
A local attacker can exploit this vulnerability with low complexity and no required privileges, but it necessitates user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, potentially allowing the attacker to execute arbitrary code or cause denial of service on the affected system.
Mitigation is addressed in a GitHub pull request at https://github.com/yoyofr/modizer/pull/133, with the fix incorporated in modizer version 4.1.1. Security practitioners should ensure systems are updated to this version or later to remediate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4731
Vulnerability details
Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in client-side modizer app enables arbitrary code execution or DoS when user opens crafted malicious file (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the integer overflow vulnerability by requiring identification, reporting, and patching to modizer version 4.1.1 or later.
Implements memory protections like ASLR and DEP to mitigate arbitrary code execution from integer overflow exploitation.
Validates information inputs to modizer to prevent integer overflows triggered by malformed data requiring user interaction.