Unrated severityNVD Advisory· Published Oct 20, 2023· Updated Feb 13, 2025
Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image
CVE-2023-45662
Description
stb_image is a single file MIT licensed library for processing images. When stbi_set_flip_vertically_on_load is set to TRUE and req_comp is set to a number that doesn’t match the real number of components per pixel, the library attempts to flip the image vertically. A crafted image file can trigger memcpy out-of-bounds read because bytes_per_pixel used to calculate bytes_per_row doesn’t match the real image array dimensions.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/nothings/stb/blob/5736b15f7ea0ffb08dd38af21067c314d6a3aae9/stb_image.hmitrex_refsource_MISC
- securitylab.github.com/advisories/GHSL-2023-145_GHSL-2023-151_stb_image_h/mitrex_refsource_CONFIRM
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/mitre
News mentions
0No linked articles in our index yet.