CVE-2017-6193

Vulnerability

APNGDis 2.8 and earlier contains a heap buffer overflow vulnerability in the compose_frame function. When processing a crafted APNG file with malformed width and height values in the IHDR chunk, the application allocates a buffer based on these values and then performs a memcpy with a size that exceeds the allocated buffer, leading to a heap overflow. The affected versions include all releases up to 2.8 [1].

Exploitation

An attacker can exploit this by providing a specially crafted PNG image with overly large width and height dimensions (e.g., 0x0F000000) in the IHDR chunk. When the application opens the file, it attempts to process the image, triggering the overflow in compose_frame during memory copy operations. No special privileges are required; the attack vector is through file opening. Remote exploitation is possible if the victim opens the malicious file [1].

Impact

Successful exploitation can lead to a denial of service or arbitrary code execution. The heap overflow can corrupt memory structures, potentially allowing an attacker to control execution flow. The CVSS score indicates high severity.

Mitigation

As of this writing, no official patch has been released for APNGDis 2.8. The software appears to be unmaintained. Users should avoid opening untrusted PNG files with APNGDis. No workaround is available.