Описание
Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:microsoft:heif_image_extension:1.2.22.0:*:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.01052
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-125
Связанные уязвимости
CVSS3: 9.1
github
3 месяца назад
Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer length before a memmove call.
EPSS
Процентиль: 63%
0.01052
Низкий
9.1 Critical
CVSS3
Дефекты
CWE-125