CVE-2024-42642 identifies a buffer overflow in Crucial MX500 SSDs running firmware M3CR046. The National Vulnerability Database (NVD) rates it 6.7, or Medium, and says Crucial reported full remediation in December 2024 through updated firmware. The exact fixed firmware revision is not established in the available official support information, so check Crucial’s update route for your specific drive rather than assuming a particular version is safe.
What the MX500 vulnerability does
NVD describes a buffer overflow triggered by specially crafted ATA packets sent from the host to the SSD controller. The affected product entry identifies Crucial MX500 Series Solid State Drives running firmware M3CR046. The record associates that firmware with 250GB, 500GB, 1TB, 2TB and 4TB MX500 capacities; it does not say that every MX500 firmware revision is vulnerable. NVD’s CVE-2024-42642 record
As an Amazon Associate I earn from qualifying purchases.
What the technical report examined
The researcher tested a 500GB CT500MX500SSD1 drive with an SM2259H-AC controller, M3CR046 firmware and NY112 flash chips. The report examines the ATA PIO DOWNLOAD-MICROCODE command and its offset-based firmware transfer handling. It describes malformed or oversized transfers that can hang the controller, as well as an overwrite beyond the download buffer. Those implementation details reflect testing of the researcher’s drive and firmware variant; they should not be treated as independently verified across every MX500 variant. Researcher’s technical report
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Does this affect your drive?
The specific firmware version named as vulnerable is M3CR046. To assess your own SSD, identify its model and installed firmware, then check the update offered for that drive through Crucial’s MX500 support page or Crucial Storage Executive, which Crucial describes as supporting MX-series SSDs.
#1 Best Overall
- Boot up faster. Load files quicker. Improve overall system responsiveness
- 300% faster than a typical hard drive
- Improves battery life because it’s 45x more energy efficient than a typical hard drive
- Micron 3D NAND – advancing the world's memory and storage technology for 40 years
- Crucial 3-year limited warranty
The support page, dated November 15, 2024, gives update paths based on the firmware already installed. For drives on M3CR046, it labels M3CR046 as the latest update for that drive. Separately, NVD says the supplier reported full remediation in December 2024 and that updated firmware is available through Crucial support. These sources do not identify the exact fixed revision, so do not assume M3CR047 or another version is the fix without an official release note confirming it.
How serious is CVE-2024-42642?
NVD records a CVSS v3.1 score of 6.7 (Medium). Its vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H: it specifies a local attack vector and high privileges required. A severity score describes the vulnerability under a scoring model; it does not predict whether a particular owner will be targeted. NVD vulnerability details
Rank #2
- 2.5-inch Solid State Drive
- 500GB
The researcher says an attacker would need permission to send ATA packets to the drive, typically root access on the host, and characterizes successful exploitation as requiring substantial research and engineering. That is the researcher’s assessment, not a guarantee of safety. The described prerequisite makes this a host-local, privileged-access issue—not an ordinary unauthenticated attack arriving over the internet. Researcher’s report and FAQ
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What MX500 owners should do
- Identify the drive and firmware. Check the exact MX500 model and installed firmware using your system’s drive information or Crucial Storage Executive.
- Check Crucial’s official update route. Use the MX500 support page or Storage Executive to determine whether an update applies to your drive. The available support information does not establish the exact CVE-fixing revision.
- Back up important files before updating. Crucial recommends making copies of important files before installing firmware. Its support page warns that an interrupted update can leave an SSD nonfunctional.
- Follow the instructions for your specific drive. Do not install firmware intended for a different model or revision, and avoid interrupting the update process.
Crucial’s product flyer describes MX500 firmware as user-upgradeable, but that does not make every firmware package interchangeable. Crucial MX500 product flyer
Rank #3
- Boot up faster. Load files quicker. Improve overall system responsiveness
- 300% faster than a typical hard drive
- Improves battery life because it’s 45x more energy efficient than a typical hard drive
- Micron 3D NAND – advancing the world's memory and storage technology for 40 years
- Crucial 3-year limited warranty
Disclosure timeline
According to the researcher, the bugs were discovered in May 2024, MITRE was notified in July, a CVE was assigned in August, and the report became public at the end of August. NVD lists September 4, 2024 as the CVE publication date and July 5, 2026 as its last-modified date. These are separate dates from the researcher’s disclosure chronology. Researcher disclosure chronology · NVD record dates
Quick Recap
Best Value
- 2.5-inch Solid State Drive
- 250GB
Rank #4
- 2.5-inch Solid State Drive
- 2TB
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
