CVE-2022-41684

What it actually does

Heap out-of-bounds read during parsing of the image file directory section in PSD files within the affected image processing library, resulting in reads from arbitrary memory addresses and denial of service.

Why it matters to the business

Processing of untrusted image files can trigger application crashes and service outages in environments handling PSD content, though low and stable EPSS combined with absence from KEV indicates limited active exploitation risk; downstream packages such as coreruleset and modsecurity-crs must be addressed due to their listed prevalence.

How an attack unfolds

An attacker creates a malformed PSD file that exploits the image file directory parsing logic, then supplies the file to any application or workflow relying on the vulnerable library; successful parsing triggers the out-of-bounds read and crashes the process.

How to fix it

Upgrade modsecurity-crs on Debian 12 and 13 to version 3.3.4-1 and update coreruleset/coreruleset to commit 87979aacb81fae13f993d0b86faa216788e909cc; recompile or redeploy any dependent applications after the library update.

How to confirm the fix worked

Confirm installed package versions match the listed fixed releases, reprocess known-good and boundary-case PSD files to verify absence of crashes, and review build or dependency manifests for the corrected library commit.

Typical attack path

1. Craft a malicious PSD file targeting the image file directory structure
2. Deliver the file to a target system or service that invokes PSD parsing
3. Trigger file processing through normal application workflows or user upload paths
4. Induce heap out-of-bounds read leading to denial of service

How to detect it

Review application and system logs for unexpected terminations or segmentation faults during PSD file handling; correlate file-processing events with crash artifacts in environments using the vulnerable library.

What your security team should do

• Apply the specified package and commit updates to all affected instances without delay given the available exploit maturity
• Restrict or sandbox processing of untrusted PSD files until patches are deployed
• Include the updated components in regular dependency scanning and vulnerability management workflows