{"answers":{"affected":"6 open source packages ship an affected version, including directxtex_desktop_2019, directxtex_desktop_win10 and directxtex_uwp.","exploited":"There is no known exploitation of GHSA-3w9w-9833-gcpv in the wild and no public exploit code.","fix":"Upgrade directxtex_desktop_2019 to 2023.1.31.1 or later.","what":"GHSA-3w9w-9833-gcpv is a memory corruption vulnerability in directxtex_desktop_2019, published on 26 Jan 2023."},"fix_prompt":"Check this codebase for GHSA-3w9w-9833-gcpv and fix it if it is affected.\n\nWhat it is: GHSA-3w9w-9833-gcpv is a memory corruption vulnerability in directxtex_desktop_2019, published on 26 Jan 2023. \nExploitation: There is no known exploitation of GHSA-3w9w-9833-gcpv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- directxtex_desktop_2019 (NuGet): affected all versions; fixed in 2023.1.31.1\n- directxtex_desktop_2019 (NuGet): affected all versions; fixed in 2023.1.31.1\n- directxtex_desktop_win10 (NuGet): affected all versions; fixed in 2023.1.31.1\n- directxtex_desktop_win10 (NuGet): affected all versions; fixed in 2023.1.31.1\n- directxtex_uwp (NuGet): affected all versions; fixed in 2023.1.31.1\n- directxtex_uwp (NuGet): affected all versions; fixed in 2023.1.31.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-3w9w-9833-gcpv/ (Markdown: https://insights.sbomify.com/GHSA-3w9w-9833-gcpv/index.md)","id":"GHSA-3w9w-9833-gcpv","markdown":"https://insights.sbomify.com/GHSA-3w9w-9833-gcpv/index.md","name":"GHSA-3w9w-9833-gcpv","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution","denial_of_service"],"network_reachable":"unknown","non_default_config":false,"product_category":"DirectXTex image library","requires_auth":"none","summary":"A memory overwrite vulnerability in DirectXTex allows attackers to potentially execute code or cause denial of service via crafted planar video textures.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nA memory overwrite bug was reported by a security researcher in the **ConvertToSinglePlane** method via the *texconv* command-line tool when given an invalid height for planar video textures such as NV12. This can be a potential security bug for any clients of the library who follow the same pattern.\n\nThis issue *does not* impact use of the DDS texture loader itself, only when combined with `ConvertToSinglePlane` for converting multi-planar video formats. All other functions in the library fail immediately if given images in planar formats.\n\n### Patches\nThe fix to the specific area as well as general hardening can be found in [this PR](https://github.com/microsoft/DirectXTex/pull/307) and will be included in the This bug has been fixed in the January 31, 2023 or later release of DirectXTex.\n\n### Workarounds\nIf your code makes use of **ConvertToSinglePlane**, you can validate that the width \u0026 height alignment requirements are met for the input image before calling the function.","ecosystems":["NuGet"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security bug in ConvertToSinglePlane when used with untrusted content from the DDS loader","id":"GHSA-3w9w-9833-gcpv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"NuGet","product":null,"products":[],"type":"memory_corruption","year":"2023"},"n_packages":6,"n_references":null,"packages":[{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_desktop_2019","purl":null,"source":"GHSA-3w9w-9833-gcpv"},{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_desktop_2019","purl":"pkg:nuget/directxtex_desktop_2019","source":"GHSA-3w9w-9833-gcpv"},{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_desktop_win10","purl":null,"source":"GHSA-3w9w-9833-gcpv"},{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_desktop_win10","purl":"pkg:nuget/directxtex_desktop_win10","source":"GHSA-3w9w-9833-gcpv"},{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_uwp","purl":null,"source":"GHSA-3w9w-9833-gcpv"},{"ecosystem":"NuGet","fixed":["2023.1.31.1"],"introduced":["0"],"last_affected":[],"package":"directxtex_uwp","purl":"pkg:nuget/directxtex_uwp","source":"GHSA-3w9w-9833-gcpv"}],"products":null,"published":"2023-01-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A memory overwrite vulnerability in DirectXTex allows attackers to potentially execute code or cause denial of service via crafted planar video textures.","url":"https://insights.sbomify.com/GHSA-3w9w-9833-gcpv/"}