CVE-2023-45664 - CVE House

Back to Database

Status published High CVE-2023-45664

Double-free in stbi__load_gif_main_outofmem in stb_image

7.3 CVSS

Vulnerability Description

stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attempt to double-free the out variable. This happens in `stbi__load_gif_main` because when the `layers * stride` value is zero the behavior is implementation defined, but common that realloc frees the old memory and returns null pointer. Since it attempts to double-free the memory a few lines below the first “free”, the issue can be potentially exploited only in a multi-threaded environment. In the worst case this may lead to code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45664

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from nothings

View All →

Wild address read in vorbis_decode_packet_rest in stb_vorbis

Out of bounds heap buffer write in stb_vorbis

Null pointer dereference in vorbis_deinit in stb_vorbis

Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbis

Off-by-one heap buffer write in start_decoder in stb_vorbis

Affected Vendor

nothings

View all reports →

Affected Software

stb

Vulnerable Versions:

<= 2.28

Timeline

Official Publish: October 20th, 2023

Last Modified: February 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1574 Hijack Execution Flow

Privilege Escalation

T1059 Command and Scripting Interpreter

T1485 Data Destruction