CVE-2024-46264

HIGH

cute_png v1.05 - Heap-based Buffer Overflow via cp_find()

Title source: llm

Description

cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h.

References (5)

Core 5

Core References

Third Party Advisory

https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8

Exploit

https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc

Exploit

https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/poc/sample8.png

View Exploit ZIP pw:eip

Third Party Advisory

https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/vulDescription.assets/image-20240527233234147.png

View Writeup ZIP pw:eip

Third Party Advisory

https://github.com/Helson-S/FuzzyTesting/blob/master/cute_headers/cute_png/heapof-r4-cp_find-cute_png-979c8/vulDescription.md

View Writeup ZIP pw:eip

Scores

CVSS v3 7.8

EPSS 0.0046

EPSS Percentile 36.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-122 CWE-787

Status published

Products (1)

randygaul/cute_png 1.05

Published Oct 01, 2024

Tracked Since Feb 18, 2026