Integer underflow in Microsoft Windows and Windows Server - CVE-2024-38517

Vulnerability identifier: #VU94061

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38517

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow within RapidJSON. A remote attacker can trick a victim to open a specially crafted file, trigger integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Microsoft Windows
Windows Server
Ubuntu
openEuler
Anolis OS
Fedora
rapidjson-dev (Ubuntu package)
rapidjson-devel
rapidjson-doc
rapidjson
rapidjson-help

Install updates from vendor's website.

Microsoft Windows - addressed in versions 10 21H2 10.0.19044.4651, 10 22H2 10.0.19045.4651, 10 1607 10.0.14393.7159, 10 1809 10.0.17763.6054, 11 21H2 10.0.22000.3079, 11 22H2 10.0.22621.3880, 11 23H2 10.0.22631.3880
Windows Server - addressed in versions 2016 10.0.14393.7159, 2022 10.0.20348.2582
rapidjson-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 1.1.0+dfsg2-7.3ubuntu0.1
rapidjson-devel - update to 1.1.0-2
rapidjson-doc - update to 1.1.0-2
rapidjson - update to 1.1.0-13
rapidjson-devel - update to 1.1.0-13
rapidjson-help - update to 1.1.0-13
rapidjson - addressed in versions 1.1.0-41.fc39, 1.1.0-41.fc40, 1.1.0-41.fc41

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38517
• https://github.com/Tencent/rapidjson/pull/1261/commits/8269bc2bc289e9d343bae51cdf6d23ef0950e001
• https://github.com/fmalita/rapidjson/commit/8269bc2bc289e9d343bae51cdf6d23ef0950e001

• Integer underflow in Microsoft products
• openEuler update for rapidjson
• Fedora 41 update for rapidjson
• Fedora 39 update for rapidjson
• Fedora 40 update for rapidjson
• Ubuntu update for rapidjson
• Anolis OS update for rapidjson