cve/2006/CVE-2006-4024.md

### [CVE-2006-4024](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4024)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

The FESTAHES_Load function in pce/hes.c in Festalon 0.5.0 through 0.5.5 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative LoadAddr value in a HES file, which is used as an offset in a memcpy operation and leads to a buffer underflow.

### POC

#### Reference
- http://aluigi.altervista.org/adv/festahc-adv.txt

#### Github
No PoCs found on GitHub currently.