CVE-2024-5847: 
vulnerability analysis and mitigation

CVE-2024-5847 is a Use-after-free vulnerability discovered in PDFium component of Google Chrome versions prior to 126.0.6478.54. The vulnerability was reported by Han Zheng (HexHive) on May 18, 2024, and was officially disclosed on June 11, 2024. This security flaw affects Google Chrome and other Chromium-based browsers (Chrome Release).

The vulnerability is classified as a Use-after-free (CWE-416) issue in the PDFium component, which could allow an attacker to potentially exploit heap corruption. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high severity issue that requires user interaction (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to potentially exploit heap corruption through a specially crafted PDF file. Given the CVSS score and vector string, successful exploitation could lead to high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction and can be triggered via a crafted PDF file. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), but does need user interaction (UI:R) (NVD).

The vulnerability has been patched in Google Chrome version 126.0.6478.54 and later. Users are advised to update their Chrome browsers to the latest version. Fedora has also released updates for both Fedora 39 and 40 with chromium-126.0.6478.55 (Fedora Update).