CVE-2018-13037

Vulnerability

The vulnerability resides in the extend_receive function within stb_image.c (line 1120) of jpeg-compressor version 0.1. A specially crafted JPEG file can trigger a global-buffer-overflow read, as demonstrated by AddressSanitizer output [1]. The flaw occurs during decoding of entropy-coded data in the JPEG image loading routine, accessible through the bmp_load function as described in the CVE [1].

Exploitation

An attacker can exploit this by crafting a malicious JPEG file and delivering it to a target system. When the file is processed by the vulnerable stb_image.c decoder via the encoder command (e.g., ./encoder ./crash_global_buffer_overflow 1.jpeg 50), the overflow is triggered [1]. The attacker needs no special privileges; only the ability to have the victim load the crafted image.

Impact

Successful exploitation results in a denial of service (application crash) due to a global-buffer-overflow. The CVE description also notes "possibly have unspecified other impact," but the provided reference only demonstrates a read-based overflow leading to a crash [1]. The attacker gains no code execution or privilege escalation based on available information.

Mitigation

As of the reference publication date (2018), no patch was available for jpeg-compressor 0.1 [1]. Users should consider avoiding use of this library for processing untrusted JPEG files, or transitioning to actively maintained alternatives. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.