CVE-2024-33078

An attacker sends a specially crafted image file to an application using the LibPAG library. The library does not properly verify the data size while processing this file, leading to a buffer overflow in process memory (buffer overflow, CWE-680). The overflow enables overwriting critical areas of the process memory and consequently executing arbitrary code on the server side or target application.

An attacker can gain full control over the vulnerable system through remote code execution (RCE) without requiring any privileges. The confidentiality, integrity, and availability of the system are at risk.

Apply patches available from the vendor according to the references. Until the fix is deployed, it is recommended to restrict the ability to upload and process image files through components using the LibPAG library and to monitor network traffic anomalies.

Tencent LibPAG version 4.3