CVE-2024-26540

EUVD-2024-23805
A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
cimgcimg
𝑥
< 3.3.3
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
clmg_projectclmg
𝑥
< 3.3.3
ADP
Debian logo
Debian Releases
Debian Product
Codename
cimg
bookworm
no-dsa
bullseye
no-dsa
buster
postponed
forky
3.5.2+dfsg-1
fixed
sid
3.5.2+dfsg-1
fixed
trixie
3.5.2+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cimg
bionic
Fixed 1.7.9+dfsg-2ubuntu0.18.04.2+esm1
released
focal
needed
jammy
Fixed 2.9.4+dfsg-3ubuntu0.1~esm1
released
mantic
ignored
noble
Fixed 3.2.1+dfsg-1ubuntu0.24.04.1~esm1
released
oracular
Fixed 3.2.1+dfsg-1ubuntu0.24.10.1
released
plucky
not-affected
questing
not-affected
xenial
needed
Common Weakness Enumeration
References
https://github.com/GreycLab/CImg/issues/403
https://github.com/GreycLab/CImg/issues/403