CVE-2024-28563

What it actually does

Buffer overflow in FreeImage 3.19.0 triggered inside Imf_2_2::DwaCompressor::Classifier::Classifier() when parsing EXR image data, resulting in local denial of service.

Why it matters to the business

Applications that process user-supplied or untrusted EXR images can be forced offline, interrupting image-handling workflows and requiring restarts or manual intervention.

How an attack unfolds

An attacker supplies a crafted EXR file to any local process that links FreeImage; the malformed data reaches the Classifier constructor, overflows an internal buffer, and crashes the process.

How to fix it

Upgrade python3-configshell on AlmaLinux 8 to version 1:1.1.28-1.el8 or later; rebuild any dependent packages that statically link FreeImage 3.19.0; replace or remove affected FreeImage binaries until patched versions are available.

How to confirm the fix worked

Confirm the installed FreeImage library version is newer than 3.19.0-r1909; test EXR loading with both benign and malformed samples to verify the crash no longer occurs.

Typical attack path

1. Place malicious EXR file on the local filesystem
2. Invoke an application or library call that opens the file with FreeImage
3. Trigger Imf_2_2::DwaCompressor::Classifier::Classifier() during decompression
4. Buffer overflow occurs and the process terminates

How to detect it

Review application and system logs for sudden crashes or segmentation faults that occur while processing .exr files; correlate with file-creation events in directories used by image-processing services.

What your security team should do

• Apply the AlmaLinux update for python3-configshell immediately
• Inventory all software that statically or dynamically links FreeImage
• Disable EXR support in image-processing pipelines until patches are deployed
• Add EXR files to file-type monitoring rules for high-risk directories