AIKIDO-2024-10177
@rive-app/canvas is vulnerable to Heap-based Buffer Overflow
89
High Risk
This Affects:
@rive-app/canvasTL;DR
Affected versions of the @rive-app/canvas library are vulnerable to a heap-based buffer overflow in the DecodeJpeg function of its C++ core. This vulnerability allows a remote attacker to perform an out-of-bounds memory write via a crafted JPEG or PNG file.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@rive-app/canvas is vulnerable to Heap-based Buffer Overflow in versions 2.1.1 - 2.19.2.
How to fix this
Upgrade the @rive-app/canvas library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.