Heap-use-after-free

2024-03-0605:40:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sixlabors.imagesharp

png

heap-use-after-free

vulnerability disclosure

information disclosure

pngdecodercore.cs

initializeimage()

png image files

conversion

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

sixlabors.imagesharp is vulnerable to a Heap-use-after-free. The vulnerability is due to improper handling of specially crafted PNG image files during conversion in its PngDecoderCore.cs file’s InitializeImage() function, potentially leading to information disclosure.