CVE-2024-56522

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada tcpdf project tcpdf. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.

Rincian

Terbit di NVD

27 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tecnickcom/TCPDF/commit/d54b97cec33f4f1a5ad81119a82085cad93cec89 patch
• https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 issue tracking
• https://tcpdf.org product
• https://www.php.net/manual/en/types.comparisons.php not applicable
• https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html