Tencent RapidJSON up to 1.1.0 reader.h ParseNumber integer underflow

Summaryinfo

A vulnerability identified as very critical has been detected in Tencent RapidJSON up to 1.1.0. This impacts the function GenericReader::ParseNumber in the library include/rapidjson/reader.h. This manipulation causes integer underflow. This vulnerability is registered as CVE-2024-38517. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Tencent RapidJSON up to 1.1.0 and classified as very critical. Affected by this vulnerability is the function GenericReader::ParseNumber in the library include/rapidjson/reader.h. The manipulation with an unknown input leads to a integer underflow vulnerability. The CWE definition for the vulnerability is CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.

It is possible to read the advisory at msrc.microsoft.com. This vulnerability is known as CVE-2024-38517 since 06/18/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/05/2026).

The vulnerability scanner Nessus provides a plugin with the ID 211111 (Fedora 41 : rapidjson (2024-5e0da8577a)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211111). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Tencent

Name

• RapidJSON

Version

• 1.0
• 1.1.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion