catdoc zero-day, NVIDIA, High-Logic Font Creator and Parallel vulnerabilities
Summary: Cisco Talos disclosed three zero-day vulnerabilities in catdoc - CVE-2024-48877 (heap buffer overflow in the xls2csv Shared String Table Record Parser), CVE-2024-52035 (integer overflow in the OLE Document File Allocation Table Parser) and CVE-2024-54028 (integer underflow in the OLE Document DIFAT Parser) - all triggered by malformed files. Talos also reported a directory traversal in Parallels Desktop for Mac 20.2.2, an integer overflow in NVIDIA cuobjdump 12.8.55, and an out-of-bounds read in High-Logic FontCreator 15.0.0.3015; the catdoc bugs were patched by a Talos researcher because the vendor was unreachable, and Debian will merge those patches into its distribution.
Key Takeaway: The catdoc vendor could not be reached to fix high-risk memory corruption bugs, so a security vendor wrote the patches itself and Debian is folding them in - a reminder that some of the parsing code sitting in your document pipelines has no maintainer answering the phone.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-48877CVE-2024-52035CVE-2024-54028CVE-2025-20001CVE-2025-23247CVE-2025-31359
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026