CVE-2024-41436

What it actually does

A buffer overflow in the DB::evaluateConstantExpressionImpl component allows memory writes beyond allocated buffers during constant expression evaluation.

Why it matters to the business

Systems using the affected document conversion library risk crashes or arbitrary code execution, potentially causing service outages or unauthorized access to processed documents.

How an attack unfolds

An attacker supplies a malicious document that reaches constant expression evaluation, triggering the buffer overflow to corrupt memory and achieve code execution or denial of service.

How to fix it

Upgrade github.com/sajari/docconv (Go) and code.sajari.com/docconv (Go) to version 1.2.1 or later.

How to confirm the fix worked

Inspect go.mod and go.sum files to confirm dependency versions meet or exceed 1.2.1; retest document conversion workflows with previously triggering inputs.

Typical attack path

1. Locate applications depending on vulnerable docconv versions
2. Prepare a crafted document input designed to trigger constant expression evaluation
3. Submit the input to the conversion process
4. Exploit resulting memory corruption for further access or disruption

How to detect it

Review application logs for crashes or errors during document conversion; inspect process memory dumps or core files for signs of buffer overruns triggered by document processing.

What your security team should do

• Prioritize immediate upgrade of all docconv dependencies to 1.2.1
• Audit and update transitive dependencies across Go projects
• Implement dependency scanning in CI/CD pipelines