CVE-2024-9029

What it actually does

A one-byte buffer over-read occurs in read_iptc_profile when the IPTC profile size is not sanitized before access, causing the linked application to crash.

Why it matters to the business

Processing of crafted images triggers application crashes and denial of service, leading to operational downtime in image-handling components of dependent packages.

How an attack unfolds

An attacker crafts an image containing an IPTC profile with an unsanitized size value and supplies it to an application using the vulnerable library; processing the image triggers the buffer over-read and immediate crash.

How to fix it

Upgrade github.com/cloudflare/cfrpki (Go) to version 1.4.0 or later to resolve the unsanitized size handling.

How to confirm the fix worked

Confirm package version meets or exceeds the fixed release, then attempt processing of test images containing oversized IPTC profiles to verify absence of crashes.

Typical attack path

1. Create image file with malformed IPTC profile
2. Deliver the image to the target application
3. Trigger metadata parsing via normal image ingestion
4. Induce crash and denial of service

How to detect it

Review application crash logs and stack traces for references to read_iptc_profile or IPTC metadata processing failures after image ingestion.

What your security team should do

• Upgrade to the fixed version 1.4.0 without delay
• Add runtime monitoring for image-processing crashes
• Restrict untrusted image ingestion until patches are applied