Vulnerability Spotlight - LibBPG Image Decoding Code Execution
Summary: Cisco Talos disclosed TALOS-2016-0223 / CVE-2016-8710, a heap write out-of-bounds vulnerability in the libbpg library's decoding of BPG images. In the restore_tqb_pixels function, an attacker-controlled integer underflow during offset calculation for a memcpy's src and dst operands produces addresses outside the original heap structures, allowing a crafted BPG image to achieve remote code execution when opened by any application using a vulnerable libbpg version.
Bottom line: The flaw sits in a library used to support the BPG format, so any application that decodes a crafted image can hand an attacker code execution - and Talos notes Snort rules 41310-41311 cover detection only, with additional rules possibly pending.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8710
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026