PT-2024-26086 · Unknown · Librtppayload.So

Yifei Xie · Published 2024-10-07 · Updated 2024-10-30 · CVE-2024-34665

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions librtppayload.so versions prior to SMR Oct-2024 Release 1

Description The issue is an out-of-bounds write in parsing h.264 format, allowing remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this issue.

Recommendations For versions prior to SMR Oct-2024 Release 1, update to SMR Oct-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the librtppayload.so module to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-34665

Affected Products

Librtppayload.So

References · 7

• https://osv.dev/vulnerability/CVE-2024-34665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34665 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=10 · Vendor Advisory
• https://t.me/cvenotify/97386 · Telegram Post
• https://twitter.com/cracbot/status/1845343774828003830 · Twitter Post
• https://twitter.com/CVEnew/status/1843545737948250326 · Twitter Post
• https://t.me/cvedetector/7323 · Telegram Post