CVE-2023-6350

HIGH

Google Chrome <119.0.6045.199 - Use After Free

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-6350. PoCs published by dywsy21.

AI-analyzed exploit summary This repository contains a fuzzing driver for CVE-2023-6350, targeting the GD library's AVIF image parsing functionality. The fuzzer uses libFuzzer to test for crashes or memory corruption in `gdImageCreateFromAvif`.

Description

Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (Chromium security severity: High)

Exploits (1)

nomisec WORKING POC

by dywsy21 · poc

https://github.com/dywsy21/CVE-2023-6350_Reproduction

View Code ZIP pw:eip

This repository contains a fuzzing driver for CVE-2023-6350, targeting the GD library's AVIF image parsing functionality. The fuzzer uses libFuzzer to test for crashes or memory corruption in `gdImageCreateFromAvif`.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: GD Library (libgd) with AVIF support

No auth needed

Prerequisites: GD Library compiled with AVIF support · libavif · clang with libFuzzer

MITRE ATT&CK