CVE-2021-3695

What it actually does

A crafted 16-bit grayscale PNG image triggers an out-of-bounds write in the heap, enabling heap data corruption or arbitrary code execution that can circumvent secure boot protections. Exploitation requires precise heap layout manipulation due to repeated write values.

Why it matters to the business

Attackers could potentially bypass boot security controls on affected systems, risking unauthorized code execution and system compromise, although the issue is complex to exploit and shows low observed activity.

How an attack unfolds

An attacker creates a malicious 16-bit grayscale PNG and delivers it to trigger parsing in the vulnerable component. The attacker must perform heap layout triage to produce usable corruption because values are written three times consecutively, limiting reliable payloads.

How to fix it

Upgrade to the fixed commit 5e9b167dce73bd6a804ab107ae4c4b95e6849597 or later in the repository. Ensure all instances use a version after the vulnerable releases.

How to confirm the fix worked

Verify the installed version or commit hash matches or exceeds the fixed commit; test PNG parsing with known-good images and confirm no crashes or corruption occur on crafted inputs.

Typical attack path

1. Locate a system running an affected version prior to the fix
2. Prepare a specially crafted 16-bit grayscale PNG image
3. Trigger image parsing through the vulnerable code path
4. Manipulate heap state to achieve corruption or code execution
5. Attempt to bypass secure boot or gain control

How to detect it

Inspect logs for PNG parsing errors or crashes involving image processing; look for repeated memory write patterns or unexpected heap allocations during image handling.

What your security team should do

• Apply the fixed commit or update to a patched release immediately
• Prioritize systems that parse untrusted PNG images during boot or startup
• Monitor EPSS and threat intelligence for any change in exploit maturity
• Review secure boot configurations as a compensating control