CVE-2020-23894: 
WildBit Viewer vulnerability analysis and mitigation

A User Mode Write Access Violation (AV) vulnerability exists in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer version 6.6. This vulnerability allows attackers to cause a denial of service (DoS) condition via a crafted TIFF file (AttackerKB, WildBit Software).

The vulnerability occurs due to a User Mode Write Access Violation in the ntdll!RtlpCoalesceFreeBlocks+0x268 component. When processing specially crafted TIFF files, the application attempts to perform a write operation to an invalid memory location, triggering an access violation. The vulnerability has been assigned a CVSS v3 Base Score of 5.5, indicating moderate severity. The attack requires local access and user interaction (AttackerKB).

When successfully exploited, this vulnerability can lead to a denial of service condition, causing the application to crash. The impact is limited to availability, with no direct impact on confidentiality or integrity (AttackerKB).

The vulnerability requires local access and user interaction to exploit. An attacker would need to convince a user to open a specially crafted TIFF file with the vulnerable version of WildBit Viewer. The attack vector is local, with low attack complexity (AttackerKB).

Users should upgrade to a version newer than WildBit Viewer 6.6. The latest version available is 6.14, which was released on August 23, 2024 (WildBit Software).