7.8
CVE-2021-26236
- EPSS 1.97%
- Veröffentlicht 18.03.2021 13:15:20
- Zuletzt bearbeitet 21.11.2024 05:55:58
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginFastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsing functionality (BITMAPINFOHEADER Structure, 'BitCount' file format field), that will end up corrupting the Structure Exception Handler (SEH). Attackers could exploit this issue to achieve code execution when a user opens or views a malformed/specially crafted CUR file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Faststone ≫ Image Viewer Version <= 7.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.97% | 0.778 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
https://voidsec.com/advisories/cve-2021-26236-faststone-image-viewer-v-7-5-stack-based-buffer-overflow/
https://voidsec.com/fuzzing-faststone-image-viewer-cve-2021-26236
https://www.exploit-db.com/exploits/49660