CVE-2024-28579

What it actually does

Buffer overflow in FreeImage_Unload() when parsing HDR images leads to application crash and denial of service.

Why it matters to the business

Local attackers can disrupt image-processing applications on affected systems, causing unplanned downtime and reduced availability of services that rely on the vulnerable library components.

How an attack unfolds

An attacker supplies a specially crafted HDR image file to any application linked against the vulnerable library; when the application calls FreeImage_Unload() the overflow occurs, crashing the process.

How to fix it

Upgrade all listed AlmaLinux 8 boost packages to version 1.66.0-10.el8 or newer; rebuild and restart any dependent applications after the update.

How to confirm the fix worked

Confirm installed package versions match or exceed 1.66.0-10.el8 for each affected boost component and test HDR image handling in representative workloads.

Typical attack path

1. Locate an application or service that loads HDR images using the affected library
2. Prepare a malicious HDR file that triggers the overflow on unload
3. Cause the target process to open and then unload the image
4. Confirm denial of service via process termination or service outage

How to detect it

Search application and system logs for abrupt process terminations or segmentation faults that coincide with HDR image load/unload operations.

What your security team should do

• Apply the listed package updates within the next maintenance window
• Review and restrict local access to systems that process untrusted image files
• Add HDR image processing to the list of high-risk operations monitored for crashes