CyberRota Analysis
AI-GeneratedA heap-based buffer overflow vulnerability exists in the xdgmime library, specifically in the _xdg_mime_magic_parse_magic_line() function, which can be exploited on little-endian systems when processing a malicious MIME magic file located in user-writable XDG data directories. This flaw may lead to application crashes or memory corruption, posing a significant risk to applications that rely on MIME type detection. Developers and organizations utilizing xdgmime for MIME type handling should prioritize patching this vulnerability to mitigate potential exploitation risks.
Original NVD Description
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.