Vulnerability Description
An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stb_image, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nothings | Stb Image.H | 2.27 |
| Fedoraproject | Fedora | 33 |
Related Weaknesses (CWE)
References
- https://github.com/nothings/stb/issues/1166ExploitIssue TrackingThird Party Advisory
- https://github.com/nothings/stb/issues/1225ExploitIssue TrackingThird Party Advisory
- https://github.com/nothings/stb/pull/1223Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://github.com/nothings/stb/issues/1166ExploitIssue TrackingThird Party Advisory
- https://github.com/nothings/stb/issues/1225ExploitIssue TrackingThird Party Advisory
- https://github.com/nothings/stb/pull/1223Third Party Advisory
FAQ
What is CVE-2021-42716?
CVE-2021-42716 is a vulnerability with a CVSS score of 7.1 (HIGH). An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the re...
How severe is CVE-2021-42716?
CVE-2021-42716 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-42716?
Check the references section above for vendor advisories and patch information. Affected products include: Nothings Stb Image.H, Fedoraproject Fedora.