CVE-2024-5436
📋 TL;DR
A type confusion vulnerability in Snapchat's LensCore component could allow attackers to cause denial of service or execute arbitrary code on affected devices. This affects Snapchat users running versions below 12.88. The vulnerability is remotely exploitable with high impact potential.
💻 Affected Systems
- Snapchat
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent malware installation.
Likely Case
Application crashes (denial of service) or limited code execution within the LensCore sandbox.
If Mitigated
No impact if patched to version 12.88 or above.
🎯 Exploit Status
Type confusion vulnerabilities typically require specific malformed input to trigger, but CVSS 9.8 suggests relatively straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.88
Vendor Advisory: https://hackerone.com/snapchat
Restart Required: Yes
Instructions:
1. Open your device's app store (Google Play Store or Apple App Store)
2. Search for Snapchat
3. If an update is available, tap 'Update'
4. After installation, restart the Snapchat application
🔧 Temporary Workarounds
Disable LensCore/Lenses
allTemporarily disable the LensCore functionality to prevent exploitation
No commands - disable via app settings if available
🧯 If You Can't Patch
- Uninstall Snapchat until patched version can be installed
- Use device-level security controls to restrict Snapchat's permissions and network access
🔍 How to Verify
Check if Vulnerable:
Check Snapchat version in app settings: Settings > About > VersionCheck Version:
No command - check within Snapchat app settingsVerify Fix Applied:
Verify version is 12.88 or higher in app settings📡 Detection & Monitoring
Log Indicators:
- Snapchat crash logs
- Unexpected LensCore process termination
- Memory access violation errors
Network Indicators:
- Unusual network traffic from Snapchat app
- Requests to unexpected domains from LensCore
SIEM Query:
Not applicable for client-side mobile application vulnerabilities