CVE-2021-36083: 
NixOS vulnerability analysis and mitigation

KDE KImageFormats versions 5.70.0 through 5.81.0 contained a stack-based buffer overflow vulnerability in the XCFImageFormat::loadTileRLE function. The vulnerability was discovered and reported through the OSS-Fuzz program on April 28, 2021, and was subsequently fixed in a later release (OSS-Fuzz Report).

The vulnerability was identified as a stack-based buffer overflow WRITE condition occurring in the XCFImageFormat::loadTileRLE function. The issue manifested in the call stack through XCFImageFormat::loadLevel and XCFImageFormat::loadHierarchy functions. The vulnerability was introduced in commit c60e77c048d32ccf743cec695743b77b2b25dc87 and was fixed in commit 297ed9a2fe339bfe36916b9fce628c3242e5be0f. The severity of this vulnerability was rated as HIGH according to the OSS-Fuzz assessment (OSS-Fuzz Vulns).

A stack-based buffer overflow vulnerability could potentially allow attackers to execute arbitrary code or cause a denial of service condition through specially crafted XCF image files (OSS-Fuzz Vulns).

The vulnerability was fixed in a commit (297ed9a2fe339bfe36916b9fce628c3242e5be0f) to the KDE KImageFormats repository. Users should upgrade to a version that includes this fix (KDE Commit).