PT-2025-2860 · Unknown · Dgif Lib.C

Published 2025-01-01 · Updated 2025-03-20 · CVE-2024-49749

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dgif lib.c (affected versions not specified)

Description The issue is related to a possible out of bounds write due to an integer overflow in DGifSlurp of dgif lib.c. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. The overflow occurs when ImageDesc.Width and ImageDesc.Height are larger than SIZE MAX, causing ImageSize to overflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ASB-A-355461643

CVE-2024-49749

Affected Products

Dgif Lib.C

References · 9

• https://osv.dev/vulnerability/ASB-A-355461643 · Vendor Advisory
• https://source.android.com/security/bulletin/2025-01-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49749 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49749 · Vendor Advisory
• https://twitter.com/xvonfers/status/1881688899099210180 · Twitter Post
• https://android.googlesource.com/platform/external/giflib/+/3281e14f6b9b85473145ee0ae33b8d4b8fbabffe · Note
• https://twitter.com/CVEnew/status/1881933288182317441 · Twitter Post
• https://t.me/cvenotify/115504 · Telegram Post
• https://t.me/cvedetector/16044 · Telegram Post