Out-of-bounds read in Synology Inc. products - CVE-2024-11131

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the video interface within the implementation of the ONVIF protocol. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system, leading to arbitrary code execution.

Affected software

How to mitigate CVE-2024-11131

External References

• https://www.synology.com/en-global/security/advisory/Synology_SA_24_24
• https://www.zerodayinitiative.com/advisories/ZDI-25-216/

Related Security Bulletins

• Out-of-bounds read in Synology Camera BC500 ,CC400W and TC500