CVE-2006-4024

CVE-2006-4024 describes a denial-of-service and potential arbitrary code execution vulnerability in Festalon versions 0.5.0 through 0.5.5. The flaw resides in the FESTAHES_Load function, where a negative LoadAddr value in a crafted HES file can lead to a buffer underflow during a memcpy operation. This vulnerability carries a CVSS score of 7.5, indicating a high severity, as it can be exploited remotely with low attack complexity and without authentication, potentially leading to a crash or compromise of the affected system. While not listed in CISA's KEV catalog, an exploit for a heap buffer overflow in Festalon 0.5 has been published on ExploitDB, suggesting exploitability, though there is no evidence of widespread active exploitation or significant community discussion.