CVE-2024-20093

CVSS 3.1 Score 4.4 of 10 (medium)

Details

Published Oct 7, 2024
Updated: Oct 10, 2024
CWE ID 125

Summary

CVE-2024-20093 identifies a vulnerability in the vdec component that allows for an out-of-bounds read due to insufficient bounds checking, potentially leading to local information disclosure. Affected products include specific MediaTek devices referenced as 'lAMRr5' and 'sYyJE8'. The exploitation of this vulnerability requires high system execution privileges but does not necessitate user interaction, posing a potential risk to confidentiality. Organizations are advised to remediate the issue by applying Patch ID ALPS09028313 as outlined in the vendor's advisory. The vulnerability has a medium severity rating, with a CVSS base score of 4.4, indicating that while it poses a significant risk, it is classified as manageable with appropriate mitigations.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share