CVE-2024-1112 is a High severity heap based buffer overflow, scored 7.3, in Resource Hacker 3.6.0.92 by Angus Johnson. A long filename argument could allow arbitrary code execution. INCIBE CERT says the issue is fixed in version 5.2.1, so update any copy of the tool you still use.
What's affected
The record and INCIBE CERT list Resource Hacker version 3.6.0.92 as affected. INCIBE's solution is to update to version 5.2.1.
The record notes that an attacker could execute arbitrary code through a long filename argument. It gives a CVSS score of 7.3 and CWE-119 and CWE-787, both memory safety classes. INCIBE gives the same 7.3 base score.
How to check if you're exposed
Resource Hacker is a desktop tool for viewing and editing Windows resources. Search for copies on workstations and build servers, including portable copies kept in tool folders.
Get-ChildItem -Path C:\ -Filter ResourceHacker.exe -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $_.VersionInfo.FileVersion }
Any file version of 3.6.0.92 needs replacing. Also check build scripts that call the tool with filenames from outside sources.
What to do now
- Search workstations, servers and build agents for ResourceHacker.exe.
- Replace 3.6.0.92 with 5.2.1 or later.
- Do not pass untrusted filenames to older copies of the tool, including from scripts.
- Remove copies that nobody uses.
- Add the tool to your approved software list with a version floor.
Why it matters
The class is a heap based buffer overflow, CWE-119 with an out of bounds write, CWE-787. A program copies a long input into a buffer that is too small and overwrites neighbouring memory, which can lead to code execution.
The path to exploitation here is a long filename given to the program, so the practical risk depends on whether untrusted input ever reaches it. For most people that means opening a crafted path through a script or a shared folder. Older copies of small tools are easy to forget, which is why inventory matters. The record's KEV flag is false.
Quick check
Which version fixes CVE-2024-1112?
INCIBE CERT says Resource Hacker 5.2.1.
How would an attacker reach it?
Through a long filename argument, per the record. Check any script that passes outside filenames to the tool.
Sources
Last reviewed: 19 October 2026.
