image-size up to 1.2.1/2.0.2 ICNS Parser infinite loop

Summaryinfo

A vulnerability has been found in image-size up to 1.2.1/2.0.2 and classified as problematic. Affected is an unknown function of the component ICNS Parser. Performing a manipulation results in infinite loop. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2025-71330. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in image-size up to 1.2.1/2.0.2. It has been classified as problematic. This affects an unknown part of the component ICNS Parser. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. The summary by CVE is:

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.

The weakness was shared by Preston Price. The advisory is shared at joshua.hu. This vulnerability is uniquely identified as CVE-2025-71330 since 06/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• image-size

Version

• 1.2.0
• 1.2.1
• 2.0.0
• 2.0.1
• 2.0.2

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion