CVE-2023-45661 Wild address read in stbi__gif_load_next in stb_image

2023-10-2023:26:08

CWE-125

GitHub_M

www.cve.org

stb_image

memory leak

out of bounds

image processing

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in stbi__gif_load_next. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.

CNA Affected

[
  {
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "version": "<= 2.28",
        "status": "affected"
      }
    ]
  }
]