Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-41132

CVE-2024-41132: SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-41132
GHSA ID
GHSA-qxrv-gp6x-rc23
EPSS Score
0.78772%
CWE
CWE-770
Published
7/22/2024
Updated
9/11/2024
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
SixLabors.ImageSharpnuget< 2.1.92.1.9
SixLabors.ImageSharpnuget>= 3.0.0, < 3.1.53.1.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how the GIF decoder handled LZW-compressed image data. The original implementation in GifDecoderCore.cs allocated a full Buffer2D<byte> for all pixel indices (width*height) before decoding, while LzwDecoder.cs's DecodePixels method processed the entire image in one pass. This allowed attackers to specify malicious dimensions leading to excessive allocations. The patches replaced this with row-by-row decoding (DecodePixelRow) using temporary buffers, significantly reducing peak memory usage. The CWEs (770/789) directly map to these unthrottled allocations based on unvalidated input values.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ * vuln*r**ility *is*ov*r** in t** Im***S**rp li*r*ry, w**r* t** pro**ssin* o* sp**i*lly *r**t** *il*s **n l*** to *x**ssiv* m*mory us*** in t** *i* ***o**r. T** vuln*r**ility is tri***r

Reasoning

T** vuln*r**ility st*ms *rom *ow t** *I* ***o**r **n*l** LZW-*ompr*ss** im*** **t*. T** ori*in*l impl*m*nt*tion in *i****o**r*or*.*s *llo**t** * *ull *u***r**<*yt*> *or *ll pix*l in*i**s (wi*t****i**t) ***or* ***o*in*, w*il* Lzw***o**r.*s's ***o**Pix