CVE-2022-1325
Quick assessment
Affected
n/a Clmg
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CImg是GREYC开源的一个用于图像处理的小型开源 C++ 工具包。 GREYC Clmg存在安全漏洞。攻击者利用该漏洞从磁盘或虚拟缓冲区读取文件时欺骗应用程序分配64GB等巨大缓冲区大小。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-1325
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
GREYC Clmg 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CImg是GREYC开源的一个用于图像处理的小型开源 C++ 工具包。 GREYC Clmg存在安全漏洞。攻击者利用该漏洞从磁盘或虚拟缓冲区读取文件时欺骗应用程序分配64GB等巨大缓冲区大小。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Clmg | Fixed in v3.1.0 | - |
|
II. Public POCs for CVE-2022-1325
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-1325
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-1325 (2)
-
https://github.com/GreycLab/CImg/pull/348 x_refsource_MISC
Vendor Advisories for CVE-2022-1325 (3)
-
https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/ x_refsource_MISC
-
https://bugzilla.redhat.com/show_bug.cgi?id=2074549 x_refsource_MISC
-
https://access.redhat.com/security/cve/CVE-2022-1325 x_refsource_MISC
Other References for CVE-2022-1325 (1)
-
https://github.com/GreycLab/CImg/issues/343 x_refsource_MISC
Same Patch Batch · n/a · 2022-08-31 · 52 CVEs total
| CVE-2022-39046 | 7.5 HIGH | GNU C Library 日志信息泄露漏洞 |
| CVE-2022-37128 | D-Link DIR-816 安全漏洞 | |
| CVE-2022-37123 | D-Link DIR-816 操作系统命令注入漏洞 | |
| CVE-2022-36619 | D-Link DIR-816 访问控制错误漏洞 | |
| CVE-2022-36203 | Doctor’s Appointment System 跨站脚本漏洞 | |
| CVE-2022-37125 | D-Link DIR-816 命令注入漏洞 | |
| CVE-2022-36201 | Doctor’s Appointment System SQL注入漏洞 | |
| CVE-2022-36202 | Doctor’s Appointment System 安全漏洞 | |
| CVE-2022-37129 | D-Link DIR-816 操作系统命令注入漏洞 | |
| CVE-2022-36568 | Tenda AC9 缓冲区错误漏洞 | |
| CVE-2022-36569 | Tenda AC9 缓冲区错误漏洞 | |
| CVE-2022-38812 | AeroCMS SQL注入漏洞 | |
| CVE-2022-37184 | Garage Management System 代码问题漏洞 | |
| CVE-2022-36566 | Rengine 操作系统命令注入漏洞 | |
| CVE-2022-37183 | Piwigo 跨站脚本漏洞 | |
| CVE-2022-28625 | Hewlett Packard Enterprise OneView 日志信息泄露漏洞 | |
| CVE-2022-37122 | Carel pCOWeb HVAC BACnet Gateway 路径遍历漏洞 | |
| CVE-2022-30318 | Honeywell ControlEdge PLC 信任管理问题漏洞 | |
| CVE-2020-35538 | libjpeg-turbo 代码问题漏洞 | |
| CVE-2022-2466 | Quarkus 环境问题漏洞 |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-90707
Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_t -
CVE-2026-90698
memcached mcmc Tokenizer proto_text.c try_read_command_ascii -
CVE-2026-90687
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use a -
CVE-2026-90686
GPAC MP4Box loader_bt.c gf_bt_report memory corruption -
CVE-2026-90685
GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
Same weakness: CWE-400
-
CVE-2026-90928
File Browser through 2.63.23 Memory Exhaustion via subtitle -
CVE-2026-90927
filebrowser through 2.63.23 Denial of Service via unbounded -
CVE-2026-88932
multer vulnerable to Denial of Service via orphaned disk wri -
CVE-2026-90582
evanchiu serverless-todo API Todo Endpoint index.js saveTodo -
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction
V. Comments for CVE-2022-1325
No comments yet