VulnerabilityDeferred

CVE-2024-45773

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects.

HIGH 7.5EPSS 0.48%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2024.09.09.00.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.48% probability · 40th percentile
CISA KEV: Not listed
Source: cve-assign@fb.com

References

https://www.facebook.com/security/advisories/cve-2024-45773

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.