CVE-2024-2410

The JsonToBinaryStream() function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/protocolbuffers/protobuf/releases/tag/v25.0	Release Notes
https://github.com/protocolbuffers/protobuf/releases/tag/v25.0	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-05-03 13:15

Updated : 2025-07-22 21:05

NVD link : CVE-2024-2410

Mitre link : CVE-2024-2410

CVE.ORG link : CVE-2024-2410

JSON object : View

Products Affected

google

protobuf

CWE

CWE-416

Use After Free

{"id": "CVE-2024-2410", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-05-03T13:15:21.700", "references": [{"url": "https://github.com/protocolbuffers/protobuf/releases/tag/v25.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/protocolbuffers/protobuf/releases/tag/v25.0", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "The JsonToBinaryStream()\u00a0function is part of the protocol buffers C++ implementation and is used to parse JSON from a stream. If the input is broken up into separate chunks in a certain way, the parser will attempt to read bytes from a chunk that has already been freed.\u00a0\n"}, {"lang": "es", "value": "La funci\u00f3n JsonToBinaryStream() es parte de la implementaci\u00f3n de los b\u00faferes de protocolo C++ y se utiliza para analizar JSON de una secuencia. Si la entrada se divide en fragmentos separados de cierta manera, el analizador intentar\u00e1 leer bytes de un fragmento que ya ha sido liberado."}], "lastModified": "2025-07-22T21:05:38.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:protobuf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8069127C-4FD6-4E80-A84A-28090748ACFC", "versionEndExcluding": "4.25.0", "versionStartIncluding": "4.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}