CVE-2024-28569

What it actually does

Buffer overflow in the Imf_2_2::Xdr::read() function of FreeImage when parsing EXR image files, enabling local arbitrary code execution.

Why it matters to the business

Attackers with local access can run malicious code on affected systems by supplying specially crafted EXR images, leading to potential system compromise and data theft.

How an attack unfolds

An attacker crafts a malicious EXR image file and supplies it to an application using the vulnerable FreeImage library, triggering the buffer overflow in Xdr::read() to execute arbitrary code.

How to fix it

Update affected packages to the fixed versions listed: libusbx (AlmaLinux:8) to 1.0.23-4.el8, libusbx-devel (AlmaLinux:8) to 1.0.23-4.el8, and libusbx-devel-doc (AlmaLinux:8) to 1.0.23-4.el8.

How to confirm the fix worked

Verify package versions match or exceed the fixed releases and test image processing workflows with sample EXR files for stability.

Typical attack path

1. Identify application using FreeImage for image processing
2. Craft malicious EXR file exploiting the buffer overflow
3. Deliver the file to the target system locally
4. Trigger processing of the image to execute payload

How to detect it

Review system and application logs for crashes or anomalous process spawns immediately after EXR image processing attempts.

What your security team should do

• Apply the listed package updates immediately on all affected systems
• Limit local user access to image-processing applications
• Audit logs for crashes or unexpected executions during EXR handling