CVE-2024-53984 - CVE House
Back to Database
Status published Medium CVE-2024-53984

Nanopb does not release memory on error return when using PB_DECODE_DELIMITED

Vulnerability Description

Nanopb is a small code-size Protocol Buffers implementation. When the compile time option PB_ENABLE_MALLOC is enabled, the message contains at least one field with FT_POINTER field type, custom stream callback is used with unknown stream length. and the pb_decode_ex() function is used with flag PB_DECODE_DELIMITED, then the pb_decode_ex() function does not automatically call pb_release(), like is done for other failure cases. This could lead to memory leak and potential denial-of-service. This vulnerability is fixed in 0.4.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-53984

Credits & Attribution

No credits recorded in the NVD database.

References

More from nanopb

View All →
CVE-2021-21401
Invalid free() call in Nanopb
High 7.1
CVE-2020-5235
Out-of-memory condition in Nanopb is potentially exploitable
Medium 6.5
CVE-2020-26243
Memory leak in nanopb
High 7.5

Affected Vendor

Affected Software

nanopb
Vulnerable Versions:
>=0.4.0, < 0.4.9.1

Timeline

Official Publish: December 2nd, 2024
Last Modified: December 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-401 CWE-755

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1486 Data Encrypted for Impact
Impact
T1562 Impair Defenses
Defense Evasion
T1203 Exploitation for Client Execution
Execution
T1213 Data from Information Repositories
Collection