CVE-2024-31570

libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file

Critical · published September 19, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

🚨 A stack-based buffer overflow lurks in the PluginXPM.cpp Load function of FreeImage, affecting versions 3.4.0 through 3.18.0! 🔥 Think of it like a crowded elevator where one extra person pushes everyone up against the buttons—too much input and things get chaotic! In this case, the overflow can lead to disastrous consequences, allowing attackers to control the stack memory. An attacker could potentially execute malicious code, gaining access to sensitive data or even taking control of the affected machine. It's absolutely devastating—this could compromise the entire system! ⚡

Put simply

Think of it like a crowded elevator where one extra person pushes everyone up against the buttons—too much input and things get chaotic! In this case, the overflow can lead to disastrous consequences, allowing attackers to control the stack memory. This vulnerability in the FreeImage library allows for a stack-based buffer overflow when processing XPM files, which can lead to arbitrary code execution if exploited.

What to do

An attacker could potentially execute malicious code, gaining access to sensitive data or even taking control of the affected machine. It's absolutely devastating—this could compromise the entire system! ⚡ Update FreeImage to version 3.18.1 immediately to patch this vulnerability. Review any applications relying on FreeImage and ensure they are running this secure version. Don’t forget to monitor your applications for any suspicious activity! 🛡️ You've got this! With these steps, you'll lock down your systems and keep your data safe. 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00605 · 48.4th percentile
Published
2024-09-19T00:00Z
EPSS history
Timeline
  • 19 SEP 00:00Z
    libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file
    cvelistv5