CVE-2024-28572: 
Homebrew vulnerability analysis and mitigation

CVE-2024-28572 is a buffer overflow vulnerability discovered in FreeImage version 3.19.0 [r1909]. The vulnerability affects the FreeImage_SetTagValue() function when processing JPEG format images. This security issue was disclosed on March 20, 2024, and primarily impacts the open-source FreeImage library (NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) that occurs within the FreeImage_SetTagValue() function during JPEG image processing. The CVSS v3.1 base score is 6.2 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating local access is required but no privileges or user interaction are needed (NVD).

When exploited, this vulnerability can lead to a denial of service (DoS) condition in applications using the affected FreeImage library. The impact is primarily focused on system availability, with no direct impact on confidentiality or integrity (GitHub Report).

The vulnerability requires local access to exploit, with no privileges or user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit once an attacker has local access to the target system (NVD).

Currently, there is no official patch available for this vulnerability. All versions of FreeImage in Debian distributions (bullseye, bookworm, sid, trixie) remain vulnerable (Debian Tracker).