CVE-2024-24146: 
Homebrew vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2024-24146) was discovered in the parseSWF_DEFINEBUTTON function of libming version 0.4.8. The vulnerability was disclosed on February 28, 2024, affecting the libming library, which is used for creating and manipulating SWF (Flash) files (NVD).

The vulnerability exists in the parseSWF_DEFINEBUTTON function where memory is allocated for Characters and Actions but never freed. The issue occurs when processing SWF files, specifically during the parsing of button definitions. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The weakness is classified as CWE-401: Missing Release of Memory after Effective Lifetime (NVD, GitHub Issue).

When exploited, this vulnerability can lead to a denial of service condition through memory exhaustion. The memory leak occurs when processing crafted SWF files, potentially causing the system to run out of available memory (NVD).

The vulnerability can be triggered by processing a specially crafted SWF file. An attacker needs to create a malicious SWF file that targets the parseSWF_DEFINEBUTTON function to exploit this vulnerability. The attack requires user interaction as the malicious file needs to be processed by the affected application (GitHub Issue).

As of the current date, there is no official patch available for this vulnerability in libming v0.4.8. Users are advised to monitor the libming repository for updates and potential security patches (GitHub Issue).