CVE-2024-28578: 
Homebrew vulnerability analysis and mitigation

A Buffer Overflow vulnerability has been identified in open source FreeImage version 3.19.0 [r1909]. The vulnerability allows a local attacker to execute arbitrary code through the Load() function when processing images in RAS format. This vulnerability was disclosed on March 20, 2024 (NVD).

The vulnerability exists in the Load() function of the PluginRAS.cpp component when processing RAS format images. The function contains heap overflow read and write vulnerabilities that can be triggered during image processing. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.4 HIGH (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-125 (Out-of-bounds Read) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with elevated privileges. The heap buffer overflow condition can lead to both read and write operations outside of allocated memory boundaries, potentially enabling code execution (GitHub Report).

The vulnerability requires local access and can be triggered through the Load() function when processing specially crafted RAS format images. Multiple proof-of-concept traces have been documented, including both read and write heap buffer overflow conditions (GitHub Report).

Currently, all versions of FreeImage in Debian distributions (bullseye, bookworm, trixie, and sid) are marked as vulnerable with no Debian Security Advisory (DSA) issued yet (Debian Tracker). Users are advised to monitor for updates and implement access controls to limit local access to affected systems until a patch is available.