THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-39684

Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow

AssignerGitHub_M
Reserved2024-06-27
Published2024-07-09
Updated2024-07-10

Description

Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.



MEDIUM: 6.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Problem types

CWE-190: Integer Overflow or Wraparound

Product status

<= 1.1.0
affected

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39684

cve.org CVE-2024-39684

nvd.nist.gov CVE-2024-39684

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-39684
© Copyright 2024 THREATINT. Made in Cyprus with +