Dohyeon An

Improper privilege management allows an unprivileged local attacker to gain root privileges on systems with automatic crash reporting enabled. The crash report processing pipeline runs as root and executes the `ldd` command on the `ExecutablePath` field of a crash file located in the world-writable `/var/crash` directory. This process causes the dynamic loader to load and execute an attacker-supplied audit module specified by the ELF's `DT AUDIT` tag, enabling arbitrary code execution with root privileges.

An out-of-bounds write issue occurs due to insufficient bounds checking. Processing a maliciously crafted video file can lead to unexpected app termination. An out-of-bounds write is a condition where the program writes data past the end of the intended buffer, potentially corrupting memory.