CVE-2022-1325

    Dashboard / Vulnerabilities / CVE-2022-1325

    CVE-2022-1325

    Published: 31 Aug 2022Last Modified: 27 Aug 2026

    Summary:

    Details: A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.

    References: https://access.redhat.com/security/cve/CVE-2022-1325, https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1325.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1325, https://bugzilla.redhat.com/show_bug.cgi?id=2074549, https://github.com/GreycLab/CImg/issues/343, https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90, https://github.com/GreycLab/CImg/pull/348

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bc010ab25a45165b9ad1df48f13eea60a59a5a58

    Affected versions

    Fixed in v3.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1325 | CVE-DB