CVE-2016-8710

HIGH

Libbpg < 0.9.4 - Heap-Based Buffer Overflow via Crafted BPG Image

Title source: manual
STIX 2.1

Description

An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be triggered via attempting to decode a crafted BPG image using Libbpg.

References (2)

Core 2
Core References
Exploit, Patch, Technical Description, Third Party Advisory, VDB Entry x_refsource_misc
http://www.talosintelligence.com/reports/TALOS-2016-0223/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95740

Scores

CVSS v3 7.8
EPSS 0.0339
EPSS Percentile 87.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (4)
Libbpg/Libbpg 0.9.4
Libbpg/Libbpg 0.9.7
libbpg_project/libbpg 0.9.4
libbpg_project/libbpg 0.9.7
Published Jan 26, 2017
Tracked Since Feb 18, 2026