CVE-2021-45340

What it actually does

A NULL pointer dereference in the stb_image.h component of libsixel allows remote attackers to trigger a denial of service through a specially crafted PICT file.

Why it matters to the business

Applications processing image files may crash unexpectedly when handling malicious PICT files, leading to service disruptions and potential loss of availability for users relying on image handling features. The issue has been public for over four years with low exploit likelihood and no known ransomware use.

How an attack unfolds

An attacker creates a malicious PICT file designed to trigger the NULL pointer dereference in the image processing library. When the vulnerable application opens or processes this file, it crashes due to the memory corruption, causing a denial of service. No authentication or special privileges are required beyond the ability to supply the crafted file.

How to fix it

Update to a fixed version of the affected component, specifically commit 177064d0aee4a331eef93e3667963c02f0b94333 or 0794478e4938d8193516ab49926e03cb068febe6 in the nodejs/node repository.

How to confirm the fix worked

Verify the installed version against the fixed commits listed for nodejs/node, and test processing of known malicious PICT files to ensure no crash occurs.

Typical attack path

1. Craft a malicious PICT file exploiting the NULL dereference in stb_image.h
2. Deliver the file to the target application via network upload, email, or local filesystem
3. Induce the application to process the file using libsixel
4. Trigger the dereference leading to application crash and denial of service

How to detect it

Look for application crashes or segmentation faults when processing PICT files in logs, monitor for high rates of failures in image parsing components.

What your security team should do

• Prioritize updating all instances of the library to the fixed commits
• Implement input validation or sandboxing for image processing workflows
• Monitor for unusual crashes in image handling services as a temporary detection measure