CVE-2024-28564

What it actually does

Buffer overflow in FreeImage's Imf_2_2::CharPtrIO::readChars() during EXR image parsing allows a local attacker to trigger a denial of service by supplying a malformed image file.

Why it matters to the business

Local processing of untrusted EXR files can cause application or service crashes on systems using the affected image library, leading to operational disruption until the process is restarted.

How an attack unfolds

An attacker with local access crafts a malicious EXR image that triggers the overflow when the vulnerable FreeImage function attempts to read character data, resulting in a crash of any application using the library to process the file.

How to fix it

Update gegl04 and gegl04-devel packages to version 0.4.4-7.el8 or later on AlmaLinux 8 systems; replace any direct use of vulnerable FreeImage 3.19.0 with a patched build.

How to confirm the fix worked

Verify package versions match the fixed releases, test EXR image loading with both valid and malformed samples to confirm absence of crashes, and review application logs for related buffer handling errors.

Typical attack path

1. Obtain local access to a system running affected software
2. Create or obtain a specially crafted EXR image file
3. Cause the target application or service to process the malicious EXR file using the vulnerable library
4. Trigger the buffer overflow leading to denial of service

How to detect it

Review system and application logs for crashes during EXR image processing; monitor for repeated process terminations or segmentation faults when handling image files from untrusted sources.

What your security team should do

• Apply the specified package updates immediately on all AlmaLinux 8 systems using gegl04
• Scan for and replace any remaining instances of FreeImage 3.19.0 in the environment
• Restrict local user access to image processing workflows until patches are deployed