Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2022-1325

Medium
5.5/10

Summary

A flaw was found in Clmg prior to v3.1.0, where with the help of a maliciously crafted "pandore" or "bmp" file with modified "dx" and "dy" header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published