CVE-2024-21522

CVSS 7.5 HIGHEPSS 0.6%CWE-129

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

10 Jul 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P

Affected products

n/a · audify

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gist.github.com/dellalibera/6bb866ae5d1cc2adaabe27bbd6d2d21e https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L53 https://github.com/almoghamdani/audify/blob/94b2fe79dc528fda2c7d59c7a0fd0e9de07dc3dc/src/opus_decoder.cpp%23L79 https://security.snyk.io/vuln/SNYK-JS-AUDIFY-6370700