CVE-2024-38517: Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow
Github: CVE-2024-38517 TenCent RapidJSON Elevation of Privilege Vulnerability
Other sources
Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38517?
CVE-2024-38517 is classified as an elevation of privilege vulnerability.
How do I fix CVE-2024-38517?
To fix CVE-2024-38517, apply the appropriate security patches provided by Microsoft for your affected product.
Which software is affected by CVE-2024-38517?
CVE-2024-38517 affects various versions of Microsoft Windows, including Windows Server and Windows 10.
Can CVE-2024-38517 lead to unauthorized access?
Yes, CVE-2024-38517 can potentially allow an attacker to gain unauthorized access to system privileges.
What is the cause of CVE-2024-38517?
CVE-2024-38517 is caused by an integer underflow in the GenericReader::ParseNumber() function of Tencent RapidJSON.