Lucene search

China National Vulnerability DatabaseCNVD-2024-08547

HistoryAug 19, 2022 - 12:00 a.m.

OTFCC Buffer Overflow Vulnerability (CNVD-2024-08547)

2022-08-1900:00:00

China National Vulnerability Database

www.cnvd.org.cn

buffer overflow

otfcc

opentype font

validation

user-supplied data

exploitation

program crash

cnvd-2024-08547

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

45.8%

JSON

OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A buffer overflow vulnerability exists in OTFCC version 0.10.4, which stems from a lack of proper validation of user-supplied data in the /release-x64/otfccdump+0x6b05ce file, and can be exploited by an attacker to cause a program crash.