CVE-2024-56522

CVE-2024-56522 is a high-severity vulnerability affecting TCPDF versions prior to 6.8.0, specifically within the unserializeTCPDFtag function. This flaw stems from the use of loose comparison (!=) and the absence of a constant-time function for comparing TCPDF tag hashes, potentially leading to information disclosure. With a CVSS score of 7.5, this network-exploitable vulnerability requires no user interaction or privileges, allowing an attacker to achieve high confidentiality impact. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.