CVE-2022-28041

What it actually does

Integer overflow in stbi__jpeg_decode_block_prog_dc allows malformed JPEG input to trigger excessive allocation or crash during progressive DC coefficient decoding.

Why it matters to the business

Applications handling untrusted images can be crashed remotely, causing service outages and requiring restarts until patched packages are deployed.

How an attack unfolds

An attacker supplies a crafted JPEG image containing malformed progressive scan data that triggers the integer overflow inside the stb_image decoder used by affected packages.

How to fix it

Upgrade fb55/css-what to commit 2db00ca221922c5b5131d798614aa043f2f6f80e; node-css-what on Ubuntu 16.04 to 2.1.0-1ubuntu0.16.04.1~esm1, on 18.04 to 2.1.0-1+deb10u1build0.18.04.1, on 20.04 to 3.2.1-1ubuntu0.1~esm1, on 22.04 to 5.1.0-2, and on Debian 11 to 4.0.0-3+deb11u1.

How to confirm the fix worked

Confirm the installed package version matches one of the listed fixed versions and test that the application no longer crashes when loading the previously crashing JPEG sample.

Typical attack path

1. Craft JPEG with malicious progressive DC data
2. Deliver image via web upload, email attachment or network fetch
3. Victim process loads the image using the vulnerable decoder
4. Integer overflow occurs leading to DoS

How to detect it

Review application logs for crashes during JPEG decoding and monitor for repeated image-processing failures from untrusted sources.

What your security team should do

• Apply the listed package updates immediately given the public exploit availability
• Scan all systems for the affected css-what and stb_image versions
• Add image decoding to sandboxed processes where possible