CVE-2024-26540: 
NixOS vulnerability analysis and mitigation

CVE-2024-26540 is a heap-based buffer overflow vulnerability discovered in Clmg before version 3.3.3. The vulnerability exists in the _load_analyze function when processing ANALYZE7.5/NIFTI files. The issue was disclosed on March 14, 2024 (NVD, GitHub Issue).

The vulnerability occurs in the _load_analyze function where after reading the header_size variable, there is no validation check if its value is bigger than 4 bytes. When a header_size smaller than 4 bytes is provided, the first argument of cimg::fread points out of bounds of the header buffer, causing an underflow in the second parameter passed to the function. The CVSS v3.1 base score is 7.8 (High) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability allows an attacker to control both the size and contents of the buffer overflow through a crafted file. This can lead to heap memory corruption and potential code execution (GitHub Issue).

The vulnerability can be triggered by passing a corrupted file as input to the load_analyze function. A proof-of-concept exploit has been demonstrated using ASAN (Address Sanitizer) to detect the heap-buffer-overflow (GitHub Issue).

Users should upgrade to Clmg version 3.3.3 or later which contains the fix for this vulnerability (NVD).