CVE-2024-4978

Malicious Code in Justice AV Solutions (JAVS) Viewer

8.7 HighIn KEV

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

26.9%Up 26.9 points since May 23, 2024

What each source reports

CVE List Score used 8.7

Malicious Code in Justice AV Solutions (JAVS) Viewer

Record: CVE-2024-4978
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.1: 8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-506
Updated: 2026-11-02

EUVDEUVD-2024-44535 8.7

Record: EUVD-2024-44535
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wf54-f8v9-v72v 8.7

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is...

Record: GHSA-wf54-f8v9-v72v
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-502, CWE-506
Updated: 2026-11-02

CISA KEV No score

Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.

Record: CVE-2024-4978
Weakness: CWE-506
Updated: 2026-11-02

NVD 8.7

Record: CVE-2024-4978
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1: 8.4 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-506
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-4978 is a high vulnerability (CVSS 8.7) in Javs Viewer, published May 23, 2024. CISA lists it as known to be exploited, since May 29, 2024. EUVD reports exploitation since May 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 26.9%, the 98th percentile. No source names a fixed version.