CVE-2024-39684Integer Overflow or Wraparound in Rapidjson

Severity
7.8HIGHNVD
EPSS
0.2%
top 63.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 9

Description

Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages17 packages

🔴Vulnerability Details

1
OSV
CVE-2024-39684: Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjso2024-07-09

📋Vendor Advisories

3
Microsoft
Github: CVE-2024-39684 TenCent RapidJSON Elevation of Privilege Vulnerability2024-07-09
Red Hat
rapidjson: pivilege escalation via integer overflow in GenericReader::ParseNumber()2024-07-09
Debian
CVE-2024-39684: rapidjson - Tencent RapidJSON is vulnerable to privilege escalation due to an integer overfl...2024

🕵️Threat Intelligence

2
Trendmicro
The July 2024 Security Update Review2024-07-09
Trendmicro
The July 2024 Security Update Review2024-07-09