Vulnerability · Published Jan 31, 2024 · Assigned by INCIBE
CVE-2024-1112Buffer Overflow Vulnerability in Resource Hacker
High 7.3
In plain English
A high-severity memory corruption in Resource Hacker from Angus Johnson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Heap-based buffer overflow vulnerability in Resource Hacker, developed by Angus Johnson, affecting version 3.6.0.92. This vulnerability could allow an attacker to execute arbitrary code via a long filename argument.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Angus Johnson | Resource Hacker | 3.6.0.92 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H