CVE-2018-14456

Vulnerability

An out-of-bounds write vulnerability exists in the DLS::Info::SaveString function in DLS.cpp of libgig version 4.1.0 [1]. The function writes a string to a buffer without proper bounds checking, leading to a heap-buffer-overflow when processing specially crafted DLS or Gigasampler files. The issue is triggered during file parsing or saving operations that call SaveString.

Exploitation

An attacker can exploit this vulnerability by supplying a malicious DLS or .gig file to an application using libgig (e.g., gigextract or other tools). No authentication or special privileges are required; the victim only needs to open the crafted file. The out-of-bounds write occurs when the SaveString function attempts to copy data beyond the allocated buffer, as demonstrated by the provided ASAN report and GDB backtrace [1].

Impact

Successful exploitation results in a heap-buffer-overflow, which can cause a denial of service (crash) or potentially allow arbitrary code execution in the context of the process using libgig. The exact impact depends on memory layout and compiler mitigations, but the vulnerability is classified as an out-of-bounds write with high severity.

Mitigation

As of the publication date (2018-07-20) and based on the available reference [1], no official patch or fixed version has been disclosed. Users should monitor the libgig project for updates and consider avoiding processing untrusted DLS or Gigasampler files until a fix is released. No workaround is provided in the reference.