Vulnerability in Audify

CVE-2024-21522

All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().decode or new OpusDecoder().decodeFloat functions it is not checked for negative values. This can lead to a process crash.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.006 (47.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-21522: held from 0.006 to 0.006.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

  • Audify — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-21522?
CVE-2024-21522 is a high-severity vulnerability in Audify, classified under Improper Validation of Array Index. CVSS score: 7.5/10. Published 2024-07-10.
How severe is CVE-2024-21522?
High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-21522 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.