CVE-2017-8326

HIGH

ImageWorsener < 1.3.0 - Denial of Service via Integer Overflow in BMP Processing

Title source: llm
STIX 2.1

Description

libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image, related to imagew-bmp.c and imagew-util.c.

References (3)

Core 3
Core References
Patch, Third Party Advisory, VDB Entry x_refsource_misc
https://blogs.gentoo.org/ago/2017/04/27/imageworsener-two-left-shift/
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201706-06

Scores

CVSS v3 8.8
EPSS 0.0243
EPSS Percentile 82.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-682
Status published
Products (1)
entropymine/imageworsener < 1.3.0
Published Apr 29, 2017
Tracked Since Feb 18, 2026