CVE-2024-32876

CVSS 3.1 Score 8.5 of 10 (high)

Details

Published Apr 24, 2024
CWE ID 502

Summary

CVE-2024-32876 is a vulnerability affecting NewPipe, an Android app for video streaming written in Java. In versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could result in Arbitrary Code Execution due to insufficient restrictions on Java's Object Serialization Stream Protocol. An attacker could create a malicious backup file, trick a user into importing it, and execute malicious code during the import process. Potentially, attackers could crash the app, steal user data, perform actions through Android APIs, and attempt JVM/Sandbox escapes. NewPipe versions 0.13.4 to 0.26.1 are vulnerable, while version 0.27.0 mitigates the risk by restricting deserializable classes, deprecating Java serialization, and using JSON serialization for new backups, along with a warning for importing backups with Java serialization.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share