CVE-2024-28574

What it actually does

Buffer overflow in FreeImage 3.19.0's opj_j2k_copy_default_tcp_and_create_tcd function during J2K image parsing triggers denial of service.

Why it matters to the business

Local crashes in applications handling J2K images can interrupt services on affected systems such as grafana-pcp on AlmaLinux 8; low exploitation likelihood reduces immediate risk but still requires prompt patching.

How an attack unfolds

An attacker with local access supplies a specially crafted J2K image to an application linked against the vulnerable FreeImage library; when the image is processed the overflow occurs in the cited function and the process terminates.

How to fix it

Upgrade grafana-pcp on AlmaLinux 8 to version 2.0.2-3.el8 or later; rebuild or replace any other packages that statically link FreeImage 3.19.0 with a patched build.

How to confirm the fix worked

Confirm package version is at or above the fixed release; attempt to load a known-triggering J2K sample in a test environment and verify the process no longer crashes.

Typical attack path

1. Craft a malicious J2K file that triggers the overflow in opj_j2k_copy_default_tcp_and_create_tcd
2. Place the file in a location read by a target application using FreeImage
3. Trigger image loading through normal application behavior or automated processing
4. Observe resulting process crash and denial of service

How to detect it

Review application and system logs for unexpected crashes or terminations while processing J2K files; correlate with file-creation events in directories used by image-processing services.

What your security team should do

• Apply the listed package update within standard change windows
• Inventory other software that depends on FreeImage and schedule upgrades
• Add J2K file handling to input-validation and fuzzing test suites
• Monitor EPSS and KEV feeds for any future rise in exploit activity