libtiff CVE-2024-4746 Heap-use-after-free in TIFF Float Predictor Encoding Analysis & POC

Vulnerability Summary: Heap-use-after-free during TIFF Encoding Overview When encoding a TIFF image to an in-memory buffer, if the image contains a float predictor, the encoder allocates a temporary buffer. After the encoder object is destroyed, this buffer is freed. However, subsequent code attempts to access this already freed buffer, resulting in a heap-use-after-free vulnerability. This vulnerability can be exploited to achieve arbitrary code execution. Scope of Impact Affected Versions: 11.3.0 – 12.3.0 Fixed Version: 13.0.0 Severity Level: High CVSS Score: 9.8 (Critical) Trigger Conditions: Using to encode a TIFF image containing a float predictor to an in-memory buffer, where the image data is of a floating-point type (e.g., or ). Remediation Upgrade libtiff to version 13.0.0 or higher. Avoid encoding TIFF images with float predictors to in-memory buffers. If usage is mandatory, ensure all buffer operations are completed before the encoder object is destroyed, or switch to file output instead of in-memory buffers. POC Code (Full Extraction) > Note: The code above is a simplified illustration. Real-world exploitation requires constructing specific data streams to trigger the predictor logic and access the freed memory. A complete exploitation chain must combine ASLR bypass techniques and RCE conditions. Additional Information Vulnerability ID: CVE-2024-4746 Reporter: p1010 Related Functions: , , Critical Error Point: Incorrect lifecycle management of the float predictor buffer within , leading to access after the object's destructor has been called.

Goal Reached Thanks to every supporter — we hit 100%!

libtiff CVE-2024-4746 Heap-use-after-free in TIFF Float Predictor Encoding Analysis & POC

More from this source