CVE-2024-5580

Deeper analysis

Allegra contains a deserialization of untrusted data vulnerability in the loadFieldMatch method that permits remote code execution. The flaw stems from insufficient validation of user-supplied input, allowing an attacker to supply a malicious serialized object. Affected installations run the code in the context of the LOCAL SERVICE account. The issue is tracked as ZDI-CAN-23452 and carries a CVSS 3.0 base score of 7.2.

An authenticated remote attacker can exploit the weakness to execute arbitrary code on the target system. Because the vulnerability requires high privileges, the attacker must already possess valid credentials with administrative access to the Allegra instance. Successful exploitation grants full control over the application process without user interaction.

The vendor addressed the issue in Allegra 7.5.2, as noted in the corresponding release notes, and the Zero Day Initiative published advisory ZDI-24-1163 detailing the flaw. Exploitation probability rose from a low baseline to a peak EPSS score of 0.1098 on 2025-12-11 before receding to the current value of 0.0575, indicating a temporary increase in observed interest after disclosure.