stb_image stbi__load_gif_main double free

Summaryinfo

A vulnerability, which was classified as critical, has been found in stb_image. This affects the function stbi__load_gif_main. This manipulation causes double free. This vulnerability is tracked as CVE-2023-45666. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in stb_image (affected version unknown). It has been declared as critical. Affected by this vulnerability is the function stbi__load_gif_main. The manipulation with an unknown input leads to a double free vulnerability. The CWE definition for the vulnerability is CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about the content of output value `*delays` upon failure. Although it sets `*delays` to zero at the beginning, it doesn’t do it in case the image is not recognized as GIF and a call to `stbi__load_gif_main_outofmem` only frees possibly allocated memory in `*delays` without resetting it to zero. Thus it would be fair to say the caller of `stbi__load_gif_main` is responsible to free the allocated memory in `*delays` only if `stbi__load_gif_main` returns a non null value. However at the same time the function may return null value, but fail to free the memory in `*delays` if internally `stbi__convert_format` is called and fails. Thus the issue may lead to a memory leak if the caller chooses to free `delays` only when `stbi__load_gif_main` didn’t fail or to a double-free if the `delays` is always freed

The weakness was disclosed 10/21/2023 as GHSL-2023-145. The advisory is shared at securitylab.github.com. This vulnerability is known as CVE-2023-45666 since 10/10/2023. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/06/2025).

The vulnerability scanner Nessus provides a plugin with the ID 232143 (Linux Distros Unpatched Vulnerability : CVE-2023-45666), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (232143). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• stb_image

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion