CVE-2024-43767

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-437687.8In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation CVE-2024-437697.8In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due CVE-2024-43775.4The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2024-437708.8In gatts_process_find_info of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (CVE-2024-437718.8In gatts_process_read_req of gatt_sr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (p CVE-2024-437729.8SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to CVE-2024-437739.8SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to ex CVE-2024-437748.8SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticate CVE-2024-437758.8SQL Injection in search course titles function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to ex CVE-2024-437768.8SQL Injection in mock exam function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbit CVE-2024-437788.8OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authentica CVE-2024-437796.5An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted