CVE-2024-29195

CVE-2024-29195 is a high-severity vulnerability in the Azure C Shared Utility library, which is used by the Azure IoT C SDK for communication with Azure Cloud Services. This flaw allows an attacker to trigger an integer wraparound, under-allocation, or heap buffer overflow through malformed buffer length parameters. Successful exploitation could lead to remote code execution (RCE) on affected IoT devices. The vulnerability has a CVSS score of 8.1 (High), indicating a network-based attack vector with high impact on confidentiality, integrity, and availability, but with high attack complexity. RCE requires a compromised Azure account, bypassing a 128KB message payload limit, and the ability to overwrite code space. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion regarding this CVE. It is not listed in the CISA KEV catalog.