CVE-2023-43281

Published: Oct 25, 2023Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stbi_load_gif_main function.

Affected (1)

Products: Nothings: Stb Image.h

Nothings

1 product

Stb Image.h

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nothings Stb Image.h	Version 2.28

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (10)

https://gist.github.com/peccc/d8761f6ac45ad55cbd194dd7e6fdfdac

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/peccc/double-stb

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMXKOKPP4BKTNUTF5KSRDQAWOUILQZNO/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVABVF4GEM6BYD5L4L64RCRSXUHY6LGN/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UVQ7ONFH5GWLMXYEAJG32A3EUKUCEVCR/

Source: cve@mitre.org

https://gist.github.com/peccc/d8761f6ac45ad55cbd194dd7e6fdfdac