CVE-2023-45666 Possible double-free or memory leak in stbi__load_gif_main in stb_image
A double-free or memory leak in stb_image's GIF loader can cause crashes or potential code execution when processing malformed images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-45666?
CVE-2023-45666 is a high-severity use after free vulnerability in nothings stb, published on 20 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed
Weakness: CWE-415
Which versions are affected by CVE-2023-45666?
It affects 1 product.
Products include Nothings Stb Image.h.
How do I fix CVE-2023-45666?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-45666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-45666 exists.
Other vulnerabilities in nothings stb
- CVE-2019-19777 Memory corruption in n/a
- CVE-2023-45664 Double-free in stbi__load_gif_main_outofmem in stb_image
- CVE-2023-43281 Use after free in n/a
- CVE-2023-45661 Wild address read in stbi__gif_load_next in stb_image
- CVE-2023-45662 Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_image
Sources
Also known as DEBIAN-CVE-2023-45666, UBUNTU-CVE-2023-45666.