Heap-Based Use-After-Free Vulnerability in stb_image Library by Nothings
CVE-2022-28042

8.8HIGH

Key Information:

Vendor

Nothings

Status
Stb Image.h
Vendor
CVE Published:
15 April 2022

What is CVE-2022-28042?

The stb_image library version 2.27 is affected by a heap-based use-after-free vulnerability within the stbi__jpeg_huff_decode function. This flaw can potentially be exploited by attackers to manipulate memory, leading to unexpected behavior or application crashes. It is crucial to address this vulnerability promptly to ensure the security and stability of applications utilizing this library.

References

https://github.com/nothings/stb/pull/1297
https://github.com/nothings/stb/issues/1289
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.