CVE-2018-13794

Vulnerability

A heap-based buffer overflow exists in the stbi__bmp_load_cont function in stb_image.h in catimg version 2.4.0. The vulnerability is triggered when processing ICO files that contain embedded BMP images. The overflow occurs at line 4748 of stb_image.h while writing to a heap buffer allocated earlier in the same function [1].

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted ICO file to catimg. No special privileges or authentication are required; the victim only needs to use catimg to display the malicious image. The overflow can be triggered via normal usage of the catimg tool.

Impact

Successful exploitation of this heap-based buffer overflow could lead to memory corruption, potentially allowing an attacker to cause a denial of service or achieve arbitrary code execution with the privileges of the user running catimg. The ASAN report confirms a write of size 1 to a heap region, indicating a classic buffer overflow scenario [1].

Mitigation

As of the provided reference, no official fix has been released for this vulnerability in catimg 2.4.0. Users should monitor the catimg repository for updates and consider avoiding the use of catimg with untrusted ICO files until a patch is available.