CVE-2007-2452: GNU Findutils

Medium severity, CVSS 6.0. EPSS: 2.2% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the visit_old_format function in locate/locate.c in locate in GNU findutils before 4.2.31 might allow context-dependent attackers to execute arbitrary code via a long pathname in a locate database that has the old format, a different vulnerability than CVE-2001-1036.

Affected products

• GNU Findutils: version 4.0 only; version 4.1 only; version 4.2.28 only; version 4.2.29 only; version 4.2.30 only

Published 2007-06-04. Last modified 2026-06-16.