CVE-2021-42716 – A buffer overflow vulnerability in stb

Q: What is the severity of CVE-2021-42716?

CVE-2021-42716 has a CVSS score of 7.1 (HIGH). A buffer overflow vulnerability in stb_image.h's PNM loader incorrectly interprets 16-bit PGM files as 8-bit, causing memory corruption when converting to RGBA. This could allow attackers to crash services or read up to 1024 bytes of heap data. Any application using stb_image.h to process PNM/PGM images is affected.

📋 TL;DR

A buffer overflow vulnerability in stb_image.h's PNM loader incorrectly interprets 16-bit PGM files as 8-bit, causing memory corruption when converting to RGBA. This could allow attackers to crash services or read up to 1024 bytes of heap data. Any application using stb_image.h to process PNM/PGM images is affected.

💻 Affected Systems

Products:

stb_image.h library
Applications embedding stb_image.h

Versions: stb_image.h 2.27 and earlier versions with PNM/PGM support

Operating Systems: All platforms using stb_image.h

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications that use stb_image.h to load PNM/PGM format images. Other image formats are not affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Service crash leading to denial of service, or limited information disclosure of heap memory contents (up to 1024 non-consecutive bytes without location control).

🟠

Likely Case

Application crash when processing malicious PNM/PGM files, causing denial of service.

🟢

If Mitigated

No impact if image processing is sandboxed or input validation prevents malicious files.

🌐 Internet-Facing: MEDIUM - Exploitable if service accepts user-uploaded PNM/PGM images, but requires specific file format and limited data disclosure.

🏢 Internal Only: LOW - Requires internal users to process malicious PNM/PGM files, which is less likely.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Proof of concept exists in GitHub issues. Exploitation requires crafting a malicious PNM/PGM file that triggers the buffer overflow during image loading.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: stb_image.h version after commit fixing the issue (post October 2021)

Vendor Advisory: https://github.com/nothings/stb/issues/1166

Restart Required: Yes

Instructions:

1. Update stb_image.h to latest version from GitHub repository. 2. Recompile any applications using the library. 3. Restart affected services.

🔧 Temporary Workarounds

Disable PNM/PGM image support

all

Modify stb_image.h configuration to disable PNM/PGM format loading

# In stb_image.h, set STBI_NO_PNM before including the header
#define STBI_NO_PNM

Input validation for image files

all

Implement server-side validation to reject PNM/PGM format uploads

🧯 If You Can't Patch

Implement strict input validation to block PNM/PGM file uploads
Sandbox image processing in isolated containers with memory limits

🔍 How to Verify

Check if Vulnerable:

Check if application uses stb_image.h version 2.27 or earlier and processes PNM/PGM images.

Check Version:

# Check stb_image.h header for version or commit hash
# grep -i "version\|commit" stb_image.h

Verify Fix Applied:

Verify stb_image.h version includes fix from GitHub commit addressing CVE-2021-42716.

📡 Detection & Monitoring

Log Indicators:

Application crashes when processing image files
Memory access violation errors in logs
Unexpected termination of image processing services

Network Indicators:

Uploads of PNM/PGM format files to vulnerable endpoints

SIEM Query:

source="application.log" AND ("segmentation fault" OR "access violation" OR "buffer overflow") AND "image"

📊 Metadata

CVE ID: CVE-2021-42716

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CWE: CWE-120

Published: October 21, 2021

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-42716, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

Stb Image.h by Nothings

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable PNM/PGM image support

Input validation for image files

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities