Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

libstb image library can leak memory with malicious GIF

CVE-2023-45661 · published 3 years ago
Summary

The libstb image handling library used in Debian can be tricked by a specially crafted GIF file to read data from memory it shouldn't access. This could expose internal information about your system. Upgrade to the latest version of libstb or apply the vendor's security patch to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libstb All versions
Debian:13 debian libstb All versions
Debian:14 debian libstb All versions
– nothings stb_image.h 2.28
cpe:2.3:a:nothings:stb_image.h:2.28:*:*:*:*:*:*:*
Ubuntu:20.04:LTS canonical libstb All versions
Original advisory text
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a...
stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__gif_load_next`. This happens because two_back points to a memory address lower than the start of the buffer out. This issue may be used to leak internal memory allocation information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published21 Oct 2023
Updated4 Nov 2026
First seen15 Sep 2026
Sources
DEBIAN-CVE-2023-45661 · OSV
CVE-2023-45661 · NVD
UBUNTU-CVE-2023-45661 · OSV
Track software like this
Free during beta