CVE-2024-45434 Use after free in n/a

Critical 9.8 Published 12 Sep 2025 Updated 12 Sep 2025

A use-after-free flaw in the BlueSDK Bluetooth stack allows attackers to achieve remote code execution within the user account context.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-45434?

CVE-2024-45434 is a critical use after free vulnerability in n/a, published on 12 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenSynergy BlueSDK (aka Blue SDK) through 6.x has a Use-After-Free. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of validating the existence of an object before performing operations on the object (aka use after free). An attacker can leverage this to achieve remote code execution in the context of a user account under which the Bluetooth process runs.

Weakness: CWE-416

Which versions are affected by CVE-2024-45434?

It affects 1 product.

Products include Opensynergy Blue Sdk.

How do I fix CVE-2024-45434?

No fix has been published for CVE-2024-45434 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-45434 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45434 exists.

Sources

Also known as GHSA-gfw9-vqj5-5mg2.