{"id":"CVE-2019-16346","details":"ngiflib 0.4 has a heap-based buffer overflow in WritePixel() in ngiflib.c when called from DecodeGifImg, because deinterlacing for small pictures is mishandled.","modified":"2026-07-08T20:15:25.331166Z","published":"2019-09-16T13:15:11.823Z","references":[{"type":"FIX","url":"https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a"},{"type":"EVIDENCE","url":"https://github.com/miniupnp/ngiflib/issues/11"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/miniupnp/ngiflib","events":[{"introduced":"cc64f7cc8fc20a945f2abd2ca771e8611f7e4128"},{"last_affected":"cc64f7cc8fc20a945f2abd2ca771e8611f7e4128"},{"fixed":"37d939a6f511d16d4c95678025c235fe62e6417a"}],"database_specific":{"cpe":"cpe:2.3:a:miniupnp_project:ngiflib:0.4:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.4"},{"last_affected":"0.4"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16346.json","vanir_signatures_modified":"2026-07-08T20:15:25Z","vanir_signatures":[{"target":{"file":"ngiflib.c"},"deprecated":false,"digest":{"line_hashes":["237808059705286189303728704739888498370","229242860648037405396880656468698488460","124731630603682325519766367357309372658","328624310187704045354111804685906575459","268124930057869837187129210907045579643","31023134387890228903570843735593166343","193339466565163149689761784093763144872","297498800914596575828030126404514455487","5601185720343475656114657374560486875","178267510075713463348512151448395775435","321398342015279822042128630076841080835","26560040010434068325631006412338067695","106133190357796406044542665402384918400","168115372304991335718461962051690690734","91976863540595785612362940767559846201","118626459655440337298746134586675295327","59296448183950155605115959862582734659","338727352457999736121563534813910053803","116091655869708970700611955148013661270","241313923583721798498167393239016259905","120365708482770233787837790524979671985","131053759489204788757460821821315826691","319741250024963548175128897504153706373","18324846332395770525032013630325475653","158283433243319755807916970051652500413","131937554007643913125836620921660157663","231344623515658086528864884266885993654","210828881339791191729507079824018751028","322707758521564882711322399228719005820","328624310187704045354111804685906575459","268124930057869837187129210907045579643","31023134387890228903570843735593166343","193339466565163149689761784093763144872","297498800914596575828030126404514455487","5601185720343475656114657374560486875","178267510075713463348512151448395775435","321398342015279822042128630076841080835","26560040010434068325631006412338067695","106133190357796406044542665402384918400","168115372304991335718461962051690690734","91976863540595785612362940767559846201","118626459655440337298746134586675295327","59296448183950155605115959862582734659","338727352457999736121563534813910053803","116091655869708970700611955148013661270","241313923583721798498167393239016259905","120365708482770233787837790524979671985","131053759489204788757460821821315826691","319741250024963548175128897504153706373","18324846332395770525032013630325475653","158283433243319755807916970051652500413","131937554007643913125836620921660157663","231344623515658086528864884266885993654","210828881339791191729507079824018751028","322707758521564882711322399228719005820"],"threshold":0.9},"id":"CVE-2019-16346-9688e601","signature_type":"Line","signature_version":"v1","source":"https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a","target":{"function":"WritePixels","file":"ngiflib.c"},"deprecated":false,"digest":{"function_hash":"299598310729035935313140039135422048081","length":2913},"id":"CVE-2019-16346-f72aab64"},{"source":"https://github.com/miniupnp/ngiflib/commit/37d939a6f511d16d4c95678025c235fe62e6417a","target":{"file":"ngiflib.c","function":"WritePixel"},"deprecated":false,"digest":{"function_hash":"60390860885510470224584324540478048947","length":2316},"id":"CVE-2019-16346-fce35e71","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}