Heap Corruption Vulnerability in PDFium Could Lead to Remote Code Execution
CVE-2024-5846

8.8HIGH

Key Information:

Vendor

Google
Status
Chrome
Vendor
CVE Published:
11 June 2024

What is CVE-2024-5846?

A use after free vulnerability was identified in the PDFium component of Google Chrome, specifically impacting versions prior to 126.0.6478.54. This flaw could potentially allow remote attackers to exploit heap corruption via specially crafted PDF files. Implementing the latest updates is crucial to mitigate the risks associated with this vulnerability and to protect users from potential exploitation.

Affected Version(s)

Chrome 126.0.6478.54

References

https://chromereleases.googleblog.com/2024/06/stable-chan...
https://issues.chromium.org/issues/341095523
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.