CVE-2024-58392: Out-of-bounds Read in icculus PhysicsFS

CVE-2024-58392 is an out-of-bounds read vulnerability in PhysicsFS through version 3.2.0. The vulnerability exists in the __PHYSFS_utf8codepoint() function, which incorrectly advances the cursor by one position when handling six-octet UTF-8 sequences. This leads to reading past the allocated name buffers. Attackers can exploit this by supplying specially crafted archive files with entry names ending in six-octet UTF-8 sequences, causing the PHYSFS_utf8stricmp() function and associated hashing mechanisms to over-read memory and potentially crash the affected application.

The vulnerability allows an attacker to cause an out-of-bounds read, which can lead to application crashes. There is no indication of code execution or data corruption beyond the read and crash. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity, requiring user interaction but no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted archives containing entry names with six-octet UTF-8 sequences to mitigate crash risks.