VULNERABILITY INTELLIGENCE

CVE-2013-3939

CVSS score7.8 HIGH

EPSS probability1.73%

CISA KEVNot currently listed

Published2020-01-02

Last modified2026-06-16

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.

Weakness classification

CWE-787: Out-of-bounds Write

Primary references

PSIRT-CNA@flexerasoftware.com — Permissions Required, Vendor Advisory
PSIRT-CNA@flexerasoftware.com — Not Applicable, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Not Applicable, Vendor Advisory