CVE-2013-3939

HIGH EPSS 74.7%
Published Jan 2, 20206y ago · Modified Jun 16, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jan 2, 2020 6y ago
Last Modified Jun 16, 2026 2w ago

Description

xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
74.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 1

VendorProductVersionRange
xnviewxnview* <2.13

References 2

  • newsgroup.xnview.com http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
    Permissions RequiredVendor Advisory
  • secunia.com http://secunia.com/advisories/52101
    Not ApplicableVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.