CVE-2024-38517
EUVD-2024-3738709.07.2024, 19:15
Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| tencent | rapidjson | 𝑥 ≤ 1.1.0 | CNA |
Windows Releases
Platform | Version | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Windows 10 |
| ||||||||
| Windows 11 |
| ||||||||
| Windows Server 2016 |
| ||||||||
| Windows Server 2019 |
| ||||||||
| Windows Server 2022 |
|
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rapidjson |
|
Common Weakness Enumeration
References