CVE-2023-39125

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is "this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs."

NTSC-CRT 2.2.1 tiene un desbordamiento de entero y escritura fuera de límites en loadBMP en bmp_rw.c porque no se valida la anchura, altura y BPP de un fichero. NOTA: la perspectiva del vendedor es "esta aplicación principal no pretendía ser un programa bien probado, es sólo algo para demostrar que funciona y para que el usuario vea cómo integrarlo en sus propios programas."

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-07-25 CVE Reserved
2023-08-17 CVE Published
2024-08-23 EPSS Updated
2024-10-08 CVE Updated
2024-10-08 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-190: Integer Overflow or Wraparound
CWE-787: Out-of-bounds Write

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
https://github.com/LMP88959/NTSC-CRT/issues/32	2024-10-08

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ntsc-crt Project Search vendor "Ntsc-crt Project"		Ntsc-crt Search vendor "Ntsc-crt Project" for product "Ntsc-crt"				2.2.1 Search vendor "Ntsc-crt Project" for product "Ntsc-crt" and version "2.2.1"		-		Affected