Integer Underflow in Google Picasa Allows Code Execution

CVE-2013-5349

Summary

An integer underflow vulnerability in Google Picasa prior to version 3.9.0 Build 137.69 can be exploited by remote attackers to execute arbitrary code. By utilizing a specially crafted JPEG tag, particularly in the context of files like Canon RAW CR2, attackers can trigger a heap-based buffer overflow, leading to potential execution of malicious code on the victim's machine.

References