ImageSharp PNG Decoder Vulnerability
CVE-2024-27929

7.1HIGH

Key Information:

Vendor

Sixlabors

Status
Imagesharp
Vendor
CVE Published:
5 March 2024

What is CVE-2024-27929?

ImageSharp, a managed and cross-platform 2D graphics library, contains a heap-use-after-free vulnerability within the InitializeImage() function located in the PngDecoderCore.cs file. This security flaw is activated when an attacker supplies a specially crafted PNG image file for conversion, potentially resulting in the unintentional disclosure of sensitive information. The vulnerability has been addressed in versions 3.1.3 and 2.1.7, emphasizing the importance of updating to secure versions to mitigate risks associated with this type of exploit.

Affected Version(s)

ImageSharp >= 3.0.0, < 3.1.3 < 3.0.0, 3.1.3

ImageSharp < 2.1.7 < 2.1.7

References

https://github.com/SixLabors/ImageSharp/security/advisori...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.