CVE-2023-45664

What it actually does

Double-free vulnerability in stbi__load_gif_main when layers * stride evaluates to zero, causing realloc to free memory and return null followed by a second free attempt on the same pointer, resulting in memory corruption that can enable code execution in multi-threaded contexts.

Why it matters to the business

Applications embedding the library for image processing face elevated risk of remote code execution when handling untrusted images in concurrent environments, potentially leading to full system compromise, data breaches, or service disruption; the issue remains unpatched in listed versions with no remediation deadline.

How an attack unfolds

An attacker supplies a crafted GIF image file designed to produce a zero layers * stride value during decoding; when the library processes the file in a multi-threaded application the out-of-memory path triggers the double-free sequence that an attacker can leverage for arbitrary code execution.

How to fix it

Replace the stb_image.h implementation with a version that corrects the double-free logic in stbi__load_gif_main; if no updated release exists, disable GIF decoding or switch to an alternative image library for untrusted inputs.

How to confirm the fix worked

Audit source code and dependency manifests for inclusion of stb_image.h, attempt to compile and execute against a test GIF that exercises the zero-stride out-of-memory path, and confirm absence of the double-free sequence under concurrent load.

Typical attack path

1. Craft a malicious GIF image that forces zero stride during GIF layer processing
2. Deliver the image to a target application that uses the library for image loading
3. Trigger concurrent GIF decoding paths in a multi-threaded environment
4. Induce the double-free condition via the out-of-memory realloc path
5. Leverage resulting memory corruption to achieve code execution

How to detect it

Monitor application logs and crash reports for double-free or heap corruption signals during GIF decoding, inspect thread stacks that invoke stbi__load_gif_main, and correlate image-processing threads with unexpected memory errors or process crashes.

What your security team should do

• Immediately inventory all products and services that statically include stb_image.h and prioritize replacement or GIF feature disablement
• Apply vendor patches or migrate to a maintained image decoding library as soon as a fixed release becomes available
• Implement runtime sandboxing or input validation around image processing routines until remediation is complete