CVE-2024-32036
Published: 15 April 2024
Summary
CVE-2024-32036 is a medium-severity Sensitive Information in Resource Not Removed Before Reuse (CWE-226) vulnerability in Sixlabors Imagesharp. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 38.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1108
Vulnerability details
ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a specially crafted JPEG or TGA image file to a software using ImageSharp, potentially…
more
disclosing sensitive information from other parts of the software in the resulting image buffer. The problem has been patched in v3.1.4 and v2.1.8.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Eradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.
The control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.
Retention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.
The explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.
The generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.
Requires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.
Requiring sanitization of media prior to removal for off-site maintenance ensures sensitive information is removed before the resource is reused or accessed externally.
Procedures include sanitization, overwriting, and disposal requirements to remove sensitive data before media reuse or release.