CVE-2023-45664 Double-free in stbi__load_gif_main_outofmem in stb_image

High 7.3 Published 20 Oct 2023 Updated 13 Feb 2025

A crafted image file can trigger a double-free vulnerability in the stb_image library, potentially leading to code execution in multi-threaded environments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-45664?

CVE-2023-45664 is a high-severity use after free vulnerability in nothings stb, published on 20 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

Weakness: CWE-415

Which versions are affected by CVE-2023-45664?

It affects 1 product.

Products include Nothings Stb Image.h.

How do I fix CVE-2023-45664?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-45664 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45664 exists.

Sources

Also known as DEBIAN-CVE-2023-45664, UBUNTU-CVE-2023-45664.