CVE-2024-41132

Katalog CVE

CVSS 7.5 · High EPSS 0,77%

Kerentanan Memory Allocation with Excessive Size Value pada sixlabors imagesharp. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

ImageSharp is a 2D graphics API. A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw. All users are advised to upgrade to v3.1.5 or v2.1.9.

Rincian

Terbit di NVD

22 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SixLabors/ImageSharp/security/advisories/GHSA-qxrv-gp6x-rc23 advisory vendor
• https://github.com/SixLabors/ImageSharp/commit/59de13c8cc47f2b402e2c43aa7024511d029d515 patch
• https://github.com/SixLabors/ImageSharp/commit/9816ca45016c5d3859986f3c600e8934bc450a56 patch
• https://github.com/SixLabors/ImageSharp/commit/b496109051cc39feee1f6cde48fca6481de17f9a patch
• https://docs.sixlabors.com/articles/imagesharp.web/processingcommands.html#securing-processing-commands product
• https://docs.sixlabors.com/articles/imagesharp/security.html product
• https://github.com/SixLabors/ImageSharp/pull/2759 issue tracking
• https://github.com/SixLabors/ImageSharp/pull/2764 issue tracking
• https://github.com/SixLabors/ImageSharp/pull/2770 issue tracking