CVE-2023-45661 — Out-of-bounds Read in STB Image.h

CWE-125 — Out-of-bounds Read4 documents4 sources
Severity
7.1HIGHNVD
CNA6.5
EPSS
0.1%
top 75.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nothings STBNothings STB Image.h
Timeline
PublishedOct 21

Description

stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5nothings/stb2.28

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
CVE-2023-45661: stb_image is a single file MIT licensed library for processing images↗2023-10-21
▶
CVEList
Wild address read in stbi__gif_load_next in stb_image↗2023-10-20
▶

📋Vendor Advisories

1
Debian
CVE-2023-45661: libstb - stb_image is a single file MIT licensed library for processing images. A crafted...↗2023
▶
CVE-2023-45661 — Out-of-bounds Read in STB Image.h | cvebase