CVE-2024-48854

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-193

Affected software

Vendor	Product	Versions
BlackBerry	QNX Software Development Platform (SDP)	8.0, 7.1 and 7.0

References

https://support.blackberry.com/pkb/s/article/140334Vendor Advisory

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488557.5Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an informat CVE-2024-488569.8Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of CVE-2024-488577.5NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a deni CVE-2024-488587.5Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a den CVE-2024-488599.1An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-48864.3The contains an IDOR vulnerability that allows a user to comment on a private post by manipulating the ID included in the request CVE-2024-488609.8An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remo CVE-2024-488617.8An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow loca CVE-2024-488629.8A link following vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers to tra CVE-2024-488639.8A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers t CVE-2024-488649.1A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerabil CVE-2024-488657.5An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulne