CVE-2020-24221

Vulnerability

The GetByte function in miniupnp/ngiflib version 0.4 contains an infinite loop when processing a crafted .gif file. The loop arises from improper handling of GIF data, causing the function to never return. This issue is documented in the GitHub issue [1].

Exploitation

An attacker with local access can trigger the denial of service by providing a malicious .gif file to the gif2tga command-line tool. No authentication or network access is required; the attacker simply runs the tool with the crafted file, which causes the program to hang indefinitely.

Impact

The vulnerability causes a denial of service (DoS). The gif2tga process becomes unresponsive, potentially consuming system resources until manually terminated. No file disclosure, remote code execution, or data loss occurs; the impact is limited to local availability disruption.

Mitigation

As of the publication date, no official patch or mitigation has been disclosed in the available references. The issue remains open. Users should avoid processing untrusted .gif files with ngiflib version 0.4 or earlier. A workaround may involve monitoring and terminating hung processes, but this does not address the root cause.