CVE-2024-38517

What it actually does

Integer underflow in GenericReader::ParseNumber() during JSON stream parsing leads to memory corruption that can be leveraged for local privilege escalation.

Why it matters to the business

Attackers who trick users into opening a malicious file can obtain elevated privileges on the affected system, risking data theft or further compromise of developer and build environments that embed this library.

How an attack unfolds

An attacker crafts a JSON document containing specially chosen numeric values that trigger the underflow in ParseNumber when the file is parsed by an application using the vulnerable RapidJSON code; the resulting memory corruption is used to escalate privileges on the local machine.

How to fix it

Upgrade fmalita/rapidjson to commit 8269bc2bc289e9d343bae51cdf6d23ef0950e001 or later; rebuild and redeploy all dependent applications and containers.

How to confirm the fix worked

Confirm the library commit hash or version string matches the fixed revision; recompile a test binary and attempt to parse a known-triggering JSON payload to verify absence of the underflow condition.

Typical attack path

1. Create a JSON file containing numeric values that trigger the integer underflow in GenericReader::ParseNumber
2. Deliver the crafted file to the target user via email, download link, or shared storage
3. Victim opens the file with an application that links against the vulnerable RapidJSON library
4. Library parses the malicious numeric field and the underflow occurs
5. Memory corruption is exploited to elevate privileges

How to detect it

Review application logs for unexpected crashes or errors during JSON parsing of files received from external sources; monitor for processes that suddenly spawn with elevated privileges after handling JSON input.

What your security team should do

• Immediately update all copies of RapidJSON to the fixed commit and rebuild dependent software
• Scan source repositories and build pipelines for the vulnerable commit hash
• Add automated dependency checks that flag RapidJSON versions prior to 8269bc2bc289e9d343bae51cdf6d23ef0950e001