debian/binwalk vulnerabilities

Latest debian/binwalk CVEs

Newest publication first

1. CVE-2026-7179 OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal

   Published 2026-04-27

   Medium·CVSS 4.8 EPSS 0.17%

   A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function read_null_terminated_string of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.file_name l...

2. DLA-4410-1 binwalk - security update

   Published 2025-12-16

   Unknown

3. DLA-3339-1 binwalk - security update

   Published 2023-02-23

   Unknown

4. CVE-2022-4510 Path Traversal in binwalk

   Published 2023-01-25

   High·CVSS 7.8 EPSS 22.9% Public exploit

   A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode...

5. CVE-2021-4287 ReFirm Labs binwalk Archive Extraction extractor.py symlink

   Published 2022-12-27

   Medium·CVSS 6.5 EPSS 2.1%

   A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possibl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.