CVE-2022-1325

MEDIUM

cimg < 3.1.0 - Denial of Service via Malicious Pandore or BMP File

Title source: llm
STIX 2.1

Description

A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.

References (6)

Core 6
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2074549
Exploit, Third Party Advisory x_refsource_misc
https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/GreycLab/CImg/issues/343
Patch, Third Party Advisory x_refsource_misc
https://github.com/GreycLab/CImg/pull/348

Scores

CVSS v3 5.5
EPSS 0.0040
EPSS Percentile 31.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-400 CWE-770
Status published
Products (1)
cimg/cimg < 3.1.0
Published Aug 31, 2022
Tracked Since Feb 18, 2026