CVE-2024-28573

What it actually does

Local buffer overflow in jpeg_read_exif_profile when parsing JPEG EXIF data causes an application crash and denial of service.

Why it matters to the business

Systems using the affected autogen packages on AlmaLinux 8 can be crashed by a local user processing specially crafted JPEG images, leading to service disruption on image-handling workflows.

How an attack unfolds

An attacker with local access supplies a malformed JPEG image that triggers jpeg_read_exif_profile; the missing bounds check on EXIF data causes a buffer overflow that terminates the process.

How to fix it

Upgrade autogen, autogen-libopts, and autogen-libopts-devel on AlmaLinux 8 to version 5.18.12-8.el8 or later; rebuild or redeploy any dependent images or containers after the package update.

How to confirm the fix worked

Verify installed package versions match or exceed 5.18.12-8.el8; test that JPEG files with large EXIF profiles no longer cause crashes in affected applications.

Typical attack path

1. Obtain local shell or execution context on the target host
2. Place or reference a crafted JPEG file containing oversized EXIF data
3. Invoke an application or library call that reaches jpeg_read_exif_profile on the file
4. Trigger the overflow and resulting crash

How to detect it

Review system and application crash logs for segmentation faults or aborts occurring during JPEG processing; correlate with recent file creation or access events involving .jpg files.

What your security team should do

• Apply the fixed autogen packages immediately on all AlmaLinux 8 systems
• Scan for and replace any locally built or vendored copies of FreeImage 3.19.0
• Add package version checks to CI/CD pipelines and container base images