Buffer Allocation Flaw in CImg by GreycLab

CVE-2022-1325

What is CVE-2022-1325?

A vulnerability exists in CImg, where specially crafted pandore or bmp files can manipulate the dx and dy header values. This manipulation can result in the application allocating excessively large buffer sizes, potentially up to 64 Gigabytes, during the reading process of the file from either disk or a virtual buffer. This behavior can be exploited by attackers to create denial of service conditions or to potentially execute arbitrary code through unregulated memory allocation.

References