CVE-2023-47994

What it actually does

An integer overflow in the LoadPixelDataRLE4 function of the BMP plugin allows out-of-bounds memory access, resulting in information disclosure, denial of service, or arbitrary code execution.

Why it matters to the business

Applications handling BMP images can be crashed, have data leaked, or be fully compromised by remote attackers, increasing risk of service disruption or unauthorized access; moderate urgency applies given stable low exploitation probability and public exploit availability.

How an attack unfolds

An attacker supplies a malicious BMP image crafted to trigger the integer overflow during RLE4 decoding; when the image is processed by a vulnerable application using the affected library, memory corruption occurs that can be leveraged for code execution or denial of service.

How to fix it

Upgrade to fixed commits f1e89f78dd72dcac3ba66d3d6f93db3f7f649219 or 978671323e157eee060880c9a17d2fcea437b724; rebuild or redeploy applications that embed the vulnerable library to ensure BMP plugin is corrected.

How to confirm the fix worked

Confirm the running application or library reports a fixed commit hash; attempt processing of known trigger BMP samples in a test environment and verify absence of crashes or unexpected memory behavior.

Typical attack path

1. Craft a malicious BMP image that triggers integer overflow in RLE4 pixel loading
2. Deliver the image to the target through email, download, or shared storage
3. Victim opens or previews the image in an affected application
4. Overflow causes memory corruption leading to RCE, data leak, or crash

How to detect it

Review application and system logs for crashes or errors during BMP file processing; inspect memory dumps or process behavior for signs of corruption when handling RLE4-encoded images.

What your security team should do

• Apply the listed commit upgrades immediately to all instances using the affected library
• Disable BMP image support or add input sanitization where patching is delayed
• Monitor public exploit repositories for weaponized samples given available exploit maturity