Description
CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx_bytes, causing crashes or heap memory disclosure into the decoded image.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
GreycLab CImg
Default version status: unaffected
0 to ≤ 4.0.6affected
References
- https://github.com/GreycLab/CImg/issues/495 ↗
- https://github.com/GreycLab/CImg ↗
- https://github.com/GreycLab/CImg/commit/b9ed613d9984f9caa1617b97e1db7e429cf14fd5 ↗
- https://github.com/GreycLab/CImg/blob/v.4.0.6/CImg.h#L55659 ↗
- https://www.vulncheck.com/advisories/greyclab-cimg-through-4.0.6-heap-out-of-bounds-read-via-integer-overflow-in-load-bmp ↗