CVE-2024-32876
CVSS 3.1 Score 8.5 of 10 (high)
Details
Summary
CVE-2024-32876 is a vulnerability affecting NewPipe, an Android app for video streaming written in Java. In versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could result in Arbitrary Code Execution due to insufficient restrictions on Java's Object Serialization Stream Protocol. An attacker could create a malicious backup file, trick a user into importing it, and execute malicious code during the import process. Potentially, attackers could crash the app, steal user data, perform actions through Android APIs, and attempt JVM/Sandbox escapes. NewPipe versions 0.13.4 to 0.26.1 are vulnerable, while version 0.27.0 mitigates the risk by restricting deserializable classes, deprecating Java serialization, and using JSON serialization for new backups, along with a warning for importing backups with Java serialization.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions