CVE-2021-42716: Buffer Overflow
An issue was discovered in stb stbimage.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when converting to RGBA, leading to a buffer overflow when later reinterpreting the result as a 16-bit buffer. An attacker could potentially have crashed a service using stbimage, or read up to 1024 bytes of non-consecutive heap data without control over the read location.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42716?
CVE-2021-42716 is a vulnerability in stb_image.h version 2.27 where the PNM loader incorrectly interprets 16-bit PGM files as 8-bit, leading to a buffer overflow.
What is the severity of CVE-2021-42716?
The severity of CVE-2021-42716 is high with a CVSS score of 7.1.
How does CVE-2021-42716 affect software?
CVE-2021-42716 affects software that uses stb_image.h version 2.27, including Nothings Stb Image.h and Fedora versions 33, 34, and 35.
What is the impact of CVE-2021-42716?
The impact of CVE-2021-42716 is that an attacker could crash a service using stb_image or potentially execute arbitrary code.
How can I fix CVE-2021-42716?
To fix CVE-2021-42716, it is recommended to update to a fixed version of stb_image.h and follow any provided patches or fixes.