CVE-2023-45667

What it actually does

Null pointer dereference combined with use of an uninitialized variable in stbi__load_gif_main when GIF decoding fails and the caller requests vertical flipping, resulting in a crash inside stbi__vertical_flip_slices.

Why it matters to the business

Applications that process untrusted GIF images using the affected library can be forced to terminate unexpectedly, causing denial of service for image-handling services and workflows.

How an attack unfolds

An attacker supplies a specially crafted GIF image that triggers a failure path inside stbi__load_gif_main. When the calling code also sets the vertical-flip flag, the library passes a null buffer and an uninitialized length value to the flip routine, crashing the process.

How to fix it

Update the stb_image single-header library to a version that correctly initializes variables and checks for NULL before calling the flip routine; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Recompile with the patched header, then feed the application both valid and malformed GIFs with the vertical-flip flag set and confirm no crash occurs and the library returns an error instead of dereferencing NULL.

Typical attack path

1. Identify an application that uses the stb_image library to decode GIF files and supports the vertical-flip option.
2. Craft a GIF that causes stbi__load_gif_main to fail and return NULL while leaving z uninitialized.
3. Deliver the image through any input channel the application accepts (file upload, network request, etc.).
4. Trigger the vertical-flip code path, causing the crash.

How to detect it

Monitor application logs and crash dumps for segmentation faults or access violations that occur immediately after GIF decoding attempts; correlate with image-processing code paths that set the vertical-flip flag.

What your security team should do

• Inventory all products and services that statically or dynamically link the stb_image library.
• Prioritize patching any internet-facing services that accept GIF uploads or process external images.
• Add runtime sandboxing or resource limits around image decoding to limit blast radius until patches are applied.