CVE-2022-1325
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with...
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.5
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
CVE-2022-1325- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
CVE List No score
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
CVE-2022-1325- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-24653 No score
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
EUVD-2022-24653- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7vq8-69px-r6f8
5.5
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with...
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
GHSA-7vq8-69px-r6f8- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-1325
5.5
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
DEBIAN-CVE-2022-1325- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-1325
5.5
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
UBUNTU-CVE-2022-1325- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer.
- Record
CVE-2022-1325- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUSN-7437-1 No score
cimg vulnerabilities
It was discovered that the CImg library did not properly check the size of images before loading them. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1325)
It was discovered that the CImg library did not correctly handle certain memory operations, which could lead to a buffer overflow. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2024-26540)
- Record
USN-7437-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cimgDebian:12 |
before 3.1.6+dfsg-1 | 3.1.6+dfsg-1 |
cimgDebian:13 |
before 3.1.6+dfsg-1 | 3.1.6+dfsg-1 |
cimgDebian:14 |
before 3.1.6+dfsg-1 | 3.1.6+dfsg-1 |
cimgUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.4+dfsg-1build11.6.5+dfsg-1 |
None known |
cimgUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.7.9+dfsg-21.7.9+dfsg-2build11.7.9+dfsg-2ubuntu0.18.04.11.7.9+dfsg-2ubuntu0.18.04.21.7.9+dfsg-2ubuntu0.18.04.2+esm1 |
None known |
cimgUbuntu:20.04:LTS |
All versions, plus listed versions 2.4.5+dfsg-1 |
None known |
cimgUbuntu:Pro:22.04:LTS |
before 2.9.4+dfsg-3ubuntu0.1~esm1, plus listed versions 2.9.4+dfsg-22.9.4+dfsg-3 |
2.9.4+dfsg-3ubuntu0.1~esm1 |
cimgUbuntu:Pro:18.04:LTS |
before 1.7.9+dfsg-2ubuntu0.18.04.2+esm1, plus listed versions 1.7.9+dfsg-21.7.9+dfsg-2build11.7.9+dfsg-2ubuntu0.18.04.11.7.9+dfsg-2ubuntu0.18.04.2 |
1.7.9+dfsg-2ubuntu0.18.04.2+esm1 |
cimgUbuntu:Pro:24.04:LTS |
before 3.2.1+dfsg-1ubuntu0.24.04.1~esm1, plus listed versions 3.2.1+dfsg-1 |
3.2.1+dfsg-1ubuntu0.24.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1325 is a medium vulnerability (CVSS 5.5) in Cimg, published August 31, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in cimg 3.1.6+dfsg-1.
References
bugzilla.redhat.com/show_bug.cgi?id=2074549
huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2
github.com/GreycLab/CImg/issues/343
github.com/GreycLab/CImg/pull/348
github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90
access.redhat.com/security/cve/CVE-2022-1325
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-1325
github.com/advisories/GHSA-7vq8-69px-r6f8
github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1325.json
security-tracker.debian.org/tracker/CVE-2022-1325
ubuntu.com/security/CVE-2022-1325
cve.org/CVERecord?id=CVE-2022-1325
ubuntu.com/security/notices/USN-7437-1
ubuntu.com/security/CVE-2024-26540