CVE-2023-45663

What it actually does

Unchecked return value from stbi__getn in stbi__hdr_load and stbi__tga_load allows reading from an uninitialized buffer or past end-of-file when the input stream is exhausted, resulting in disclosure of adjacent memory contents.

Why it matters to the business

Processing of untrusted image files in applications using the library can leak sensitive data from process memory, increasing risk of data exposure and regulatory non-compliance.

How an attack unfolds

An attacker supplies a specially crafted TGA or HDR image that causes the stream to reach EOF during header or pixel data reads; because the return value is ignored, the function proceeds with uninitialized buffer contents that are then returned to the caller or used in further processing, exposing memory.

How to fix it

Upgrade the stb_image.h library to a version that adds explicit checks on the return value of stbi__getn in both stbi__hdr_load and stbi__tga_load before using the buffer contents; recompile all dependent applications after the update.

How to confirm the fix worked

Inspect source for presence of return-value checks after stbi__getn calls inside the two load functions; test with crafted short or truncated TGA/HDR files and confirm that no uninitialized memory is copied into output buffers or returned to callers.

Typical attack path

1. Craft a malicious TGA or HDR image file that triggers early EOF in stbi__getn
2. Deliver the image to an application that uses stb_image for loading
3. Trigger image parsing via normal file open or thumbnail generation paths
4. Observe or exfiltrate the disclosed memory contents returned by the load function

How to detect it

Review application logs for image-load failures or unusual buffer sizes; examine crash dumps or memory snapshots collected after image processing for unexpected data patterns originating from image decoder buffers.

What your security team should do

• Identify all products and services that statically include or link against stb_image.h
• Prioritize patching in any component that accepts user-supplied images
• Add runtime image-format validation or sandboxing around image decoding until the library is updated
• Track upstream stb_image releases for the availability of a corrected single-file header