CVE-2023-45662

What it actually does

Out-of-bounds read during vertical image flip when stbi_set_flip_vertically_on_load is enabled and req_comp mismatches actual pixel components, causing memcpy to use incorrect bytes_per_pixel for bytes_per_row calculation.

Why it matters to the business

Applications that load untrusted images with the library risk crashes or leakage of adjacent memory contents, potentially exposing sensitive data processed by image-handling code.

How an attack unfolds

An attacker crafts an image file with mismatched component counts, delivers it to a vulnerable application that calls stbi_set_flip_vertically_on_load(TRUE) before loading, and triggers the out-of-bounds memcpy read during vertical flip processing.

How to fix it

Update to a patched version of stb_image.h that corrects the bytes_per_pixel calculation in the flip logic; if no update is available, avoid enabling stbi_set_flip_vertically_on_load or validate component counts before loading.

How to confirm the fix worked

Recompile with the updated library, retest image loading under the flip and req_comp conditions using both valid and malformed inputs, and confirm absence of out-of-bounds access via memory sanitizer or bounds checking.

Typical attack path

1. Identify target application using stb_image that enables vertical flip on load
2. Craft malicious image with component count mismatch
3. Deliver image via upload, download, or file system access
4. Trigger image load path that sets flip flag and mismatched req_comp
5. Observe crash or memory disclosure from out-of-bounds read

How to detect it

Review application logs for abnormal termination or memory errors during image loading with flip enabled; inspect source for calls to stbi_set_flip_vertically_on_load combined with req_comp parameters; scan for use of stb_image in image ingestion paths.

What your security team should do

• Inventory all products and dependencies using stb_image.h
• Prioritize patching or disabling the flip feature in internet-facing image processors
• Add runtime validation of image component counts before enabling vertical flip
• Monitor upstream stb_image releases for the corrective patch