CVE-2024-28574: 
Homebrew vulnerability analysis and mitigation

A Buffer Overflow vulnerability has been identified in FreeImage version 3.19.0 [r1909]. The vulnerability affects the opj_j2k_copy_default_tcp_and_create_tcd() function when processing images in J2K format. This security issue was disclosed on March 20, 2024 (NVD).

The vulnerability is classified as a buffer overflow issue that occurs in the opj_j2k_copy_default_tcp_and_create_tcd() function within the J2K image processing component. According to the CVSS 3.1 scoring system, it has received a base score of 6.2 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability has been categorized as CWE-121 (Stack-based Buffer Overflow) (NVD).

When exploited, this vulnerability can lead to a denial of service (DoS) condition. The buffer overflow occurs during the reading of images in J2K format, potentially causing the application to crash or become unresponsive (Github Report).

The vulnerability requires local access to exploit, with no privileges required and no user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit under the right conditions (NVD).

Currently, all versions of FreeImage in Debian distributions (bullseye, bookworm, trixie, and sid) are marked as vulnerable with no security updates (DSA) available yet (Debian Tracker).