CVE-2024-39684 — Integer Overflow or Wraparound in Rapidjson
Severity
7.8HIGHNVD
EPSS
0.2%
top 63.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 9
Description
Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages17 packages
🔴Vulnerability Details
1OSV▶
CVE-2024-39684: Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjso↗2024-07-09
📋Vendor Advisories
3Red Hat
▶
Debian▶
CVE-2024-39684: rapidjson - Tencent RapidJSON is vulnerable to privilege escalation due to an integer overfl...↗2024