CVE-2024-3207 is a medium severity (CVSS 5.5) heap based buffer overflow in the ReadUnsigned function of the Simd image processing library by ermig1979, in versions up to 6.0.134. The record names no fixed version, so check the project for a patch and limit what data the library reads.
What's affected
Simd up to and including 6.0.134. The affected function is ReadUnsigned in SimdMemoryStream.h. The record says an exploit has been disclosed publicly and adds that the vendor was contacted early about the disclosure but did not respond.
No fixed version appears in the record, and the VulDB and file sharing links it lists were not reviewed. Do not assume a later release is fixed. Check the project repository and its release notes directly.
The vector shows a local attack with user interaction, which is why the score is medium: it relies on a user opening a crafted file or data stream.
The weakness class: CWE-122, heap based buffer overflow. The NVD record scores it 5.5 (medium) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description says the issue was rated as critical (VulDB wording), while NVD scores it 5.5, Medium.
How to check if you're exposed
Simd is a C++ library, so it is usually compiled into other software or vendored in source form. Search your repositories for it.
grep -rl "SimdMemoryStream" .
If the header turns up, record the version of the vendored copy and compare it with 6.0.134. A dependency scan can also catch packaged copies.
What to do now
- Search your source and build systems for vendored Simd code.
- Check the upstream repository for a fix and update when one is available.
- Avoid feeding untrusted memory streams or files to the affected reader.
- If no fix appears, assess whether you can patch the function locally or replace the dependency.
Why it matters
This is CWE-122, a heap based buffer overflow. A stream reader that trusts lengths from the data can write past its buffer. The memory safety class is old and well understood.
What makes this record awkward is the absent fix. For unmaintained or unresponsive upstreams, the safe path is to know where the code lives in your estate, keep untrusted data away from it, and plan to replace it.
Quick check
What if there is no fixed version?
Treat the library as unpatched. Reduce exposure by controlling what data reaches the affected function, look for a vendor or fork fix, and track the issue until it is resolved or the dependency is replaced.
Sources
- References in the NVD record (not individually reviewed): VulDB entry 259054 and a shared folder with the original report
- Safeguard Gold entry for CVE-2024-3207
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
