CVE-2024-33428
Published: 01 May 2024
Summary
CVE-2024-33428 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Stsaz Phiola. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-33428 is a heap-based buffer overflow (CWE-122) located at conv.c:68 in stsaz phiola version 2.0-rc22. The flaw is triggered when the application processes a specially crafted .wav file, and it carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and no required privileges.
An unauthenticated remote attacker can supply the malicious .wav file to a victim; once the file is opened or processed, the overflow enables arbitrary code execution with the privileges of the phiola process. User interaction is required to initiate processing of the file.
Public references consist of a GitHub issue report and accompanying proof-of-concept artifacts demonstrating the crash and overflow; no vendor advisory, patch release, or mitigation guidance is referenced in the available materials. The EPSS score remains flat at 0.0524 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31167
Vulnerability details
Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .wav file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in phiola allows remote code execution via crafted WAV file, enabling Exploitation for Client Execution (T1203).
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.