CVE-2024-28576

What it actually does

Buffer overflow in the opj_j2k_tcp_destroy function of FreeImage 3.19.0 when parsing J2K format images allows a local process to trigger a denial of service by supplying a malicious image file.

Why it matters to the business

Applications that process J2K images on the affected system can be crashed by a local user, leading to service outages or loss of image-handling functionality until the process is restarted.

How an attack unfolds

A local attacker crafts a J2K image that triggers the vulnerable function path in FreeImage during image loading, causing the overflow and immediate crash of the calling application.

How to fix it

Upgrade the affected package to the fixed version js-d3-flame-graph 3.0.2-2.el8 (AlmaLinux 8) or later; rebuild or redeploy any applications that statically link the vulnerable FreeImage library.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release; test image loading with known-good J2K files to verify continued operation without crashes.

Typical attack path

1. Obtain local access to a system running the vulnerable FreeImage library
2. Prepare a specially crafted J2K image file that exercises the opj_j2k_tcp_destroy code path
3. Cause a local application to load the malicious image
4. Trigger the buffer overflow resulting in denial of service

How to detect it

Review system logs and application crash reports for unexpected terminations during J2K image processing; correlate with file-access events involving .j2k or .jp2 files shortly before crashes.

What your security team should do

• Apply the vendor-supplied package update immediately on all affected AlmaLinux 8 systems
• Scan for any custom builds or containers that embed the vulnerable FreeImage version and rebuild them
• Restrict local user access to image-processing services until patches are deployed