CVE-2024-28582

What it actually does

Buffer overflow in rgbe_RGBEToFloat() during HDR image parsing in FreeImage 3.19.0 allows local arbitrary code execution with full system privileges.

Why it matters to the business

Local compromise of systems that process HDR images can lead to full attacker control, data theft, or ransomware deployment; the issue affects many AlmaLinux 8 installations through dependent packages with a remediation deadline that has long passed.

How an attack unfolds

An attacker supplies a malicious HDR file to any application linked against the vulnerable FreeImage library; the malformed RGBE data triggers the overflow in rgbe_RGBEToFloat(), overwriting memory and executing attacker-controlled code without authentication or user interaction.

How to fix it

Upgrade all listed AlmaLinux 8 packages to the fixed versions: git, git-all, git-core, git-core-doc, git-credential-libsecret, git-daemon, git-email, git-gui, git-instaweb, git-subtree, git-svn, gitk, gitweb, perl-Git, and perl-Git-SVN to 2.27.0-1.el8 or later; rebuild or replace any custom builds that statically link the vulnerable FreeImage library.

How to confirm the fix worked

Verify package versions match the fixed releases, scan for the vulnerable FreeImage binary, and test HDR image processing with known-good and known-bad samples to confirm the overflow is no longer reachable.

Typical attack path

1. Locate or deliver a malicious HDR image to a target system running vulnerable FreeImage
2. Trigger image loading via any application that uses the library
3. Exploit buffer overflow to gain arbitrary code execution
4. Establish persistence or escalate privileges on the compromised host

How to detect it

Review system and application logs for unexpected crashes or errors during HDR image loading; monitor process creation and memory anomalies around image-processing binaries; check for post-exploitation artifacts such as new scheduled tasks or unusual outbound connections initiated after image handling.

What your security team should do

• Immediately apply the listed package updates across all AlmaLinux 8 systems
• Inventory applications that depend on FreeImage and prioritize patching of image-processing workflows
• Add HDR file handling to the list of high-risk inputs monitored by endpoint detection