CVE catalog

CVE-2018-13794

catimg: CVE-2018-13794

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.54% · Oct 25, 2026

A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancatimgsid2.8.0-1fixed
Debiancatimgforky2.8.0-1fixed
Debiancatimgtrixie2.7.0-4fixed
Debiancatimgbookworm2.7.0-2fixed
Ubuntucatimg18.042.4.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancatimgsourcesid2.5.0-1not yet assignedNot reported[903711]
Debiancatimgsourceforky2.5.0-1not yet assignedNot reported[903711]
Debiancatimgsourcetrixie2.5.0-1not yet assignedNot reported[903711]
Debiancatimgsourcebookworm2.5.0-1not yet assignedNot reported[903711]

[Debian bug #903711]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [catimg]Fixed
    Details (2)

    • 2.7.0-2 · amd64 · bookworm

      Fixed · Fixed: 2.5.0-1

      dsa · catimg · debian · bookworm; dsa · catimg · debian · 12

    • 2.7.0-2 · arm64 · bookworm

      Fixed · Fixed: 2.5.0-1

      dsa · catimg · debian · bookworm; dsa · catimg · debian · 12

[Debian 13 (Trixie)]

  • [catimg]Fixed
    Details (2)

    • 2.7.0-4 · amd64 · trixie

      Fixed · Fixed: 2.5.0-1

      dsa · catimg · debian · 13

    • 2.7.0-4 · arm64 · trixie

      Fixed · Fixed: 2.5.0-1

      dsa · catimg · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]