CVE-2023-1570

low-risk
Published 2023-03-22

A vulnerability, which was classified as problematic, has been found in syoyo tinydng. Affected by this issue is the function __interceptor_memcpy of the file tiny_dng_loader.h. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. It is recommended to apply a patch to fix this issue. VDB-223562 is the identifier assigned to this vulnerability.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Tinydng

Affected Vendors

Tinydng Project

References (10)

Exploit https://github.com/10cksYiqiyinHangzhouTechnology/tinydngSecurityIssueReport1
Exploit https://github.com/syoyo/tinydng/issues/28
Exploit https://github.com/syoyo/tinydng/issues/29
Permissions Required https://vuldb.com/?ctiid.223562
Third Party Advisory https://vuldb.com/?id.223562
Exploit https://github.com/10cksYiqiyinHangzhouTechnology/tinydngSecurityIssueReport1
Exploit https://github.com/syoyo/tinydng/issues/28
Exploit https://github.com/syoyo/tinydng/issues/29
Permissions Required https://vuldb.com/?ctiid.223562
Third Party Advisory https://vuldb.com/?id.223562
19
/ 100
low-risk
Severity 13/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal