CVE-2023-39125

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not validated. NOTE: the vendor's perspective is "this main application was not intended to be a well tested program, it's just something to demonstrate it works and for the user to see how to integrate it into their own programs."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-391285.5GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.CVE-2023-391295.5GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-re CVE-2023-391305.5GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.CVE-2023-391357.8An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.CVE-2023-391365.5An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafte CVE-2023-391377.8An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.CVE-2023-391387.8An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.CVE-2023-391397.8An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.CVE-2023-39145.3A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to CVE-2023-391417.5webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.CVE-2023-391439.8PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. Th CVE-2023-391447.5Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.