CVE-2018-12447 — Integer Overflow or Wraparound in Project Libbpg

CWE-190 — Integer Overflow or WraparoundCWE-787 — Out-of-bounds Write2 documents2 sources
Severity
8.8HIGHNVD
EPSS
1.3%
top 19.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Libbpg Project Libbpg
Timeline
PublishedJun 15
Latest updateMay 13

Description

The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that leads to a heap-based buffer overflow and remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-jwq7-3mj8-j9gm: The restore_tqb_pixels function in hevc_filter↗2022-05-13
▶