CVE-2024-34666
Published: 08 October 2024
Summary
CVE-2024-34666 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Samsung Android. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-34666 is an out-of-bounds write vulnerability (CWE-787) that occurs during H.264 format parsing in a specific mode inside librtppayload.so on Samsung devices. The flaw affects builds prior to the October 2024 security maintenance release and carries a CVSS 3.1 score of 7.5.
Remote attackers can trigger the issue over the network to achieve arbitrary code execution with system-level privileges. Successful exploitation requires user interaction and presents high attack complexity, as indicated by the CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Samsung’s October 2024 security bulletin addresses the issue by updating librtppayload.so in the SMR Oct-2024 Release 1, which is the recommended mitigation for affected devices. The associated EPSS score remains flat at 0.0510 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34965
Vulnerability details
Out-of-bounds write in parsing h.264 format in a specific mode in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.