CVE-2024-39684
highpriority · track · 0EPSS 0.004 · 35 %ileDEEUNLRUEPSS · scored 2026-10-22
Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (46)
Products and version ranges known to be affected.
- Microsoft Windows 10 Windows Terminalall versionscert_bundDEcpe:/o:microsoft:windows_10:windows_terminal
- Microsoft Windows Server 2008 R2 SP1all versionscert_bundDEcpe:/o:microsoft:windows_server:2008_r2_sp1
- Microsoft Windows Server 2012all versionscert_bundDEcpe:/o:microsoft:windows_server_2012:::server_core_installation
- Microsoft Windows Server 2016all versionscert_bundDEcpe:/o:microsoft:windows_server_2016:server_2016:r2
- Microsoft Windows Server 2019all versionscert_bundDEcpe:/o:microsoft:windows_server_2019:server_core_installation
- Microsoft Windows Server 2022 23H2 Editionall versionscert_bundDEcpe:/o:microsoft:windows_server_2022:23h2_edition
- Microsoft Windows Server 2022 Datacenter: Azure Editionall versionscert_bundDEcpe:/o:microsoft:windows_server_2022:datacenter_azure_edition
advisories (3)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0279Kwetsbaarheden verholpen in Microsoft WindowsNL2024-07-09csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Windows.
- SCA-2025-0006Vulnerability affecting picoScan and multiScan2025-04-28csaf · sick_psirtDE
SICK has identified a Denial of Service vulnerability (CVE-2025-32472) in picoScan and multiScan, which can cause the web page to become unresponsive. Due to their architectural design, these products are not affected by the other vulnerabilities listed in this advisory. Currently SICK is not aware of any public exploits specifically targeting the vulnerability. SICK recommends applying the mitigation for CVE-2025-32472.
- WID-SEC-W-2024-1579Microsoft Windows: Mehrere SchwachstellenDeutsch2024-07-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Versionen von Microsoft Windows und Microsoft Windows Server ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-39684cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-39684/cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39684cnnvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39684enisa_euvd
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39684nvd
- https://security.netapp.com/advisory/ntap-20240905-0003/nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan