Description

A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-20T14:17:00.590Z",
  "pubdate": "2026-09-20T14:17:00.590Z",
  "executiveSummary": "A critical integer overflow vulnerability exists in the decode_bmp_pixel_data function within the LibGfx component of SerenityOS.\nThis vulnerability is triggered through the manipulation of the 'height' parameter in a BMP image file, potentially leading to heap-based buffer overflows or memory corruption.\nThe vulnerability is remotely exploitable, though the attack complexity is rated as high and exploitation is considered difficult.\nThe vulnerability affects SerenityOS versions up to commit 3d83e4509fd20d7438e1ae8470ffe668c136229c.\nWhile a 55-byte Proof of Concept (PoC) successfully triggers the underlying issue in the image-decode fuzz target, concrete evidence of an effective, weaponized exploit remains limited.\nGiven the nature of the overflow, the primary risk involves memory corruption which could theoretically lead to arbitrary code execution or denial of service depending on the memory layout and surrounding protections.",
  "technicalDetails": "The vulnerability resides in the decode_bmp_pixel_data function within Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp. The defect stems from an arithmetic calculation involving the 'height' argument provided within a maliciously crafted BMP file header.\nThe integer overflow occurs when the height parameter is manipulated to produce an extremely large value that, when used in subsequent memory allocation calculations (such as calculating the buffer size required for pixel data), exceeds the maximum value representable by the integer type used by the compiler. This leads to a wrapped-around, smaller-than-intended memory allocation.\nBecause the allocation size is smaller than the actual image data being processed, the function subsequently performs an out-of-bounds write (heap overflow) when attempting to copy or decode the pixel data into the insufficient memory buffer.\nThe attack flow requires an attacker to deliver a specially crafted BMP image to a system utilizing the LibGfx component for image processing. When the vulnerable library parses the header of the malicious image, the unchecked arithmetic operation triggers the overflow. The exploit is executed remotely, as the parser processes image data from untrusted sources, such as web browsers or image viewers.\nAlthough the vulnerability is triggered by a small 55-byte file via the image-decode fuzz target, the primary constraint on exploitation is the difficulty in controlling the heap state to achieve meaningful primitives beyond a generic crash (Denial of Service).\nPost-exploitation impact, while difficult to achieve, could potentially include memory corruption that compromises the integrity of the LibGfx component. If an attacker can successfully manipulate the heap layout, they might transition from a simple out-of-bounds write to redirecting control flow or leaking sensitive memory contents.\nThe vulnerability remains present in versions up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. The flaw highlights a failure in input validation where image metadata dimensions are trusted without verifying that the product of the image dimensions does not exceed the addressable memory bounds of the allocation function."
}