CVE-2024-21524

CVE-2024-21524 is a critical Out-of-bounds Read vulnerability affecting all versions of the node-stringbuilder package, specifically the magiclen stringbuilder product. This flaw allows for information disclosure by incorrectly calculating memory length when calling ToBuffer, ToString, or CharAt with non-empty string inputs, potentially returning previously allocated memory. With a CVSS score of 9.1 (CRITICAL), it presents a low-complexity attack vector that can be exploited remotely without user interaction, leading to high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.