CVE-2024-21640

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-21640

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21640.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-21640

Aliases

GHSA-3h3j-38xq-v7hh

Published

2024-01-13T07:40:10.324Z

Modified

2026-07-22T02:50:55.534062Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

OOB Access in CefVideoConsumerOSR::OnFrameCaptured

Details

Chromium Embedded Framework (CEF) is a simple framework for embedding Chromium-based browsers in other applications.CefVideoConsumerOSR::OnFrameCaptured does not check pixel_format properly, which leads to out-of-bounds read out of the sandbox. This vulnerability was patched in commit 1f55d2e.

Database specific

{
    "cwe_ids": [
        "CWE-125"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21640.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "commit1f55d2e"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/chromiumembedded/cef

Affected ranges

Type

GIT

Repo

https://github.com/chromiumembedded/cef

Events

Introduced

Fixed

1f55d2e12f62cfdfbf9da6968fde2f928982670b

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21640.json"

vanir_signatures

[
    {
        "source": "https://github.com/chromiumembedded/cef/commit/1f55d2e12f62cfdfbf9da6968fde2f928982670b",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "182114888642407309289002422740730981595",
                "296728380801254310489291266876244496634",
                "241511323707073456792638107520557170878",
                "10727605419003596955656702577756804537",
                "243822518250932802393613637683933259708",
                "299680549457429420900426016945286924349",
                "251336482468436322243211565332479761014",
                "208378345422564264645486803523415692874",
                "212967058314038606452021376936875727844",
                "154530266926391543847892294392838129080",
                "290944518280409255956800925671705596064"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-21640-c8ef74f2",
        "target": {
            "file": "libcef/browser/osr/host_display_client_osr.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/chromiumembedded/cef/commit/1f55d2e12f62cfdfbf9da6968fde2f928982670b",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "182559361334402104883307413342929000010",
                "99365231113449201707149582469580869947",
                "16930715518199782558403055733526987617"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-21640-cbc8d9cd",
        "target": {
            "file": "libcef/browser/osr/video_consumer_osr.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/chromiumembedded/cef/commit/1f55d2e12f62cfdfbf9da6968fde2f928982670b",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "51077143238130847293850459808008072074",
            "length": 354.0
        },
        "id": "CVE-2024-21640-d25313f2",
        "target": {
            "function": "CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory",
            "file": "libcef/browser/osr/host_display_client_osr.cc"
        },
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-22T02:50:55Z"