Skip to content
Threat Feed
Subscribe

Tag

Format-String

1 brief RSS
high advisory

CVE-2024-58366 - SurrealDB Format String Vulnerability Leading to RCE

A high-severity format string vulnerability, CVE-2024-58366, exists in SurrealDB versions before 1.1.1 within the `rquickjs Exception::throw_type` function, allowing attackers with scripting privileges to achieve arbitrary memory reading or remote code execution with SurrealDB process privileges by injecting malicious format string sequences into error inputs.

SurrealDB < 1.1.1 format-string remote-code-execution privilege-escalation database
2t 1c