CVE-2023-45662 Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image

2023-10-2023:26:11

CWE-125

GitHub_M

www.cve.org

cve-2023-45662

stb_image

heap buffer overflow

memcpy

out-of-bounds read

mit licensed library

image processing

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.9%

JSON

stb_image is a single file MIT licensed library for processing images. When stbi_set_flip_vertically_on_load is set to TRUE and req_comp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memcpy out-of-bounds read because bytes_per_pixel used to calculate bytes_per_row doesn’t match the real image array dimensions.

CNA Affected

[
  {
    "vendor": "nothings",
    "product": "stb",
    "versions": [
      {
        "version": "<= 2.28",
        "status": "affected"
      }
    ]
  }
]