PT-2024-26088 · Unknown · Librtppayload.So

Published 2024-10-07 · Updated 2024-10-30 · CVE-2024-34667

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions librtppayload.so versions prior to SMR Oct-2024 Release 1

Description The issue is an out-of-bounds write in parsing h.265 format, which allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.

Recommendations For versions prior to SMR Oct-2024 Release 1, update to SMR Oct-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the librtppayload.so module to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-34667

Affected Products

Librtppayload.So

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-34667 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34667 · Vendor Advisory
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=10 · Vendor Advisory
• https://t.me/cvedetector/7325 · Telegram Post
• https://twitter.com/CVEnew/status/1843545735511347706 · Twitter Post
• https://t.me/cvenotify/97388 · Telegram Post
• https://twitter.com/cracbot/status/1845343778128945466 · Twitter Post