CVE-2023-43786 PoC — Libx11: stack exhaustion from infinite recursion in putsubimage()

Source

https://github.com/jfrog/jfrog-CVE-2023-43786-libX11_DoS

Associated Vulnerability

Title: Libx11: stack exhaustion from infinite recursion in putsubimage() (CVE-2023-43786)
Description:A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

Readme

# CVE-2023-43786 Proof-of-Concept

### Overview

This is a DoS Proof-of-Concept of libX11 Denial of Service vulnerability CVE-2023-43786.  
It will trigger the integer overflow and cause an infinite loop.  
The vulnerable versions are: libX11 1.8.6 and below and libXpm 3.5.16.  
For a comprehensive understanding, check out the accompanying [blog post](https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-one/) for in-depth details.

### Dependencies

* A vulnerable version of both libXpm and libX11
* `xpmutils` installed

### Usage

1. Make sure you have `xpmutils` installed:
```
sudo apt-get install xpmutils
```

2. Run the PoC:
```
sxpm cve-2023-43786.xpm
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →