CVE-2024-41131 Out-of-bounds Write in SixLabors ImageSharp

2024-07-2214:24:42

CWE-787

GitHub_M

www.cve.org

imagesharp

gif decoder

out-of-bounds write

upgrade

v3.1.5

v2.1.9

denial of service

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

23.9%

JSON

ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upgrade to v3.1.5 or v2.1.9.

CNA Affected

[
  {
    "vendor": "SixLabors",
    "product": "ImageSharp",
    "versions": [
      {
        "version": "< 2.1.9",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.1.5",
        "status": "affected"
      }
    ]
  }
]