Use After Free in SixLabors.ImageSharp

Root

Cause

CVE-2024-27929 is a heap-use-after-free vulnerability found in the InitializeImage() function of PngDecoderCore.cs in the SixLabors.ImageSharp library [2][4]. This memory corruption flaw occurs when the PNG decoder attempts to access previously freed memory during the initialization of an image object [1].

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted PNG image file to an application that uses ImageSharp for image conversion or processing [2][4]. No special authentication or network position is required; the attack vector is local or remote delivery of the malicious file through typical file upload or processing pipelines.

Impact

Successful exploitation results in a use-after-free condition, which can lead to information disclosure [2][4]. An attacker may be able to read sensitive memory contents, potentially exposing data that should otherwise remain inaccessible.

Mitigation

The vulnerability has been patched in ImageSharp versions 3.1.3 and 2.1.7 [1][4]. All users are advised to upgrade to these or later versions. No workarounds are available [4]. The issue was addressed via a pull request that backported the fix to the affected release branches [1][3].