CVE-2024-28562

What it actually does

Buffer overflow in FreeImage 3.19.0's Imf_2_2::copyIntoFrameBuffer() component when parsing EXR image files, enabling local arbitrary code execution.

Why it matters to the business

Systems using the vulnerable library on AlmaLinux 8 allow local attackers to run unauthorized code, risking data tampering or system compromise; low exploit likelihood reduces immediate operational urgency despite the 2024 disclosure.

How an attack unfolds

An attacker with local access supplies a malicious EXR image that triggers the overflow during processing by the affected component in smartmontools or dependent software, leading to code execution in the context of the calling process.

How to fix it

Upgrade smartmontools on AlmaLinux 8 to version 1:7.1-1.el8 or later to resolve the underlying FreeImage dependency issue.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 1:7.1-1.el8 and test that EXR image processing no longer triggers crashes or unexpected behavior with known trigger files.

Typical attack path

1. Obtain local access to a system running the vulnerable package
2. Craft or obtain a malicious EXR image file exploiting the buffer overflow in copyIntoFrameBuffer()
3. Cause the target application to read the malformed image
4. Achieve arbitrary code execution via the overflow

How to detect it

Review local process execution logs and application error logs for unexpected crashes or code paths during EXR file handling; no widespread exploitation artifacts are known given the low EPSS and lack of KEV listing.

What your security team should do

• Apply the fixed package version immediately on all AlmaLinux 8 systems
• Scan for any remaining instances of the vulnerable FreeImage library
• Limit local user access to image-processing workflows where feasible
• Monitor EPSS and exploit maturity indicators for any future increase in risk