CVE-2024-38517: Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow

Deferred

AliasesMGASA-2024-0371UBUNTU-CVE-2024-38517USN-7125-1+2 more

Published 09-07-2024Last modified 05-09-2024

Vulnerability summary

CVE-2024-38517 is a high (CVSS 7.8) Integer Underflow (Wrap or Wraparound) vulnerability in tencent rapidjson. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 31.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

0.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

09-07-2024
PublishedVulnerability first disclosed.
05-09-2024
Last modifiedVulnerability information updated.

Description

Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.8

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.38% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine1 product

rapidjson< 1.1.0-r6 | < 1.1.0-r7

Debian1 product

rapidjsonAll versions (No fix recorded) | < 1.1.0+dfsg2-7.4

Mageia1 product

rapidjson< 1.1.0-6.1.mga9

Tencent1 product

rapidjson≤ 1.1.0

Ubuntu1 product

rapidjson< 0.12~git20141031-3ubuntu0.1~esm1 | < 1.1.0+dfsg2-3ubuntu0.1~esm1 | < 1.1.0+dfsg2-5ubuntu1+esm1 | < 1.1.0+dfsg2-7ubuntu0.1~esm1 | < 1.1.0+dfsg2-7.2ubuntu0.1~esm1

5 vendors · 5 products