PT-2024-31942 · Cute Png · Cute Png

Published 2024-10-01 · Updated 2024-10-04 · CVE-2024-46274

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cute png version 1.05

Description A heap buffer overflow issue was discovered in the cp stored() function at cute png.h. This issue can be exploited via the cp stored() function.

Recommendations For cute png version 1.05, consider disabling the cp stored() function as a temporary workaround until a patch is available. Restrict access to the cute png library to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-46274

Affected Products

Cute Png

References · 9

• 🔥 https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc · Exploit
• 🔥 https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/poc/sample10.png · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-46274 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46274 · Vendor Advisory
• https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2 · Note
• https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.md · Note
• https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r65280-cp_stored-cute_png-543c2/vulDescription.assets/image-20240527233813133.png · Note
• https://t.me/cvedetector/6747 · Telegram Post
• https://twitter.com/CVEnew/status/1841119821632590158 · Twitter Post