CVE-2024-27929CWE-416

Use After Free in SixLabors.ImageSharp

High · published March 5, 2024

CVSS v3.1
7.1
EPSS
0%
Percentile
27.7
In the wild
Unconfirmed
What it is

ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's InitializeImage() function of PngDecoderCore.cs file. This vulnerability is triggered when an attacker passes a specially crafted PNG image file to ImageSharp for conversion, potentially leading to information disclosure. This issue has been patched in versions 3.1.3 and 2.1.7.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.7th percentile
Weakness
CWE-416 · Use After Free
Published
2024-03-05T16:30Z
EPSS history
Timeline
  • 05 MAR 16:30Z
    Use After Free in SixLabors.ImageSharp
    cvelistv5