What is the CVSS score of CVE-2023-45666?

CVE-2023-45666 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Stb Image H CVE-2023-45666

CRITICAL

Double Free (CWE-415)

2023-10-21 security-advisories@github.com

Information Disclosure Stb Image H

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 21, 2023 - 00:15 nvd

CRITICAL 9.8

DescriptionNVD

stb_image is a single file MIT licensed library for processing images. It may look like stbi__load_gif_main doesn’t give guarantees about the content of output value *delays upon failure. Although it sets *delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to stbi__load_gif_main_outofmem only frees possibly allocated memory in *delays without resetting it to zero. Thus it would be fair to say the caller of stbi__load_gif_main is responsible to free the allocated memory in *delays only if stbi__load_gif_main returns a non null value. However at the same time the function may return null value, but fail to free the memory in *delays if internally stbi__convert_format is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free delays only when stbi__load_gif_main didn’t fail or to a double-free if the delays is always freed

AnalysisAI

stb_image is a single file MIT licensed library for processing images. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-415. stb_image is a single file MIT licensed library for processing images. It may look like stbi__load_gif_main doesn’t give guarantees about the content of output value *delays upon failure. Although it sets *delays to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to stbi__load_gif_main_outofmem only frees possibly allocated memory in *delays without resetting it to zero. Thus it would be fair to say the caller of stbi__load_gif_main is responsible to free the allocated memory in *delays only if stbi__load_gif_main returns a non null value. However at the same time the function may return null value, but fail to free the memory in *delays if internally stbi__convert_format is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free delays only when stbi__load_gif_main didn’t fail or to a double-free if the delays is always freed Affected products include: Nothings Stb Image.H.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.