Wine-Bugs

wine-bugs@list.winehq.org

May 2026

1 participants
802 discussions

[Bug 56590] New: Buffer Overflow in jpeg_decoder_initialize
by WineHQ Bugzilla May 1, 2026

May 1, 2026

https://bugs.winehq.org/show_bug.cgi?id=56590 Bug ID: 56590 Summary: Buffer Overflow in jpeg_decoder_initialize Product: Wine Version: 9.7 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: windowscodecs Assignee: wine-bugs(a)winehq.org Reporter: franco(a)blackwinghq.com Distribution: --- The vulnerable jpeg_decoder_initialize function in file libjpeg.c (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.…) is used to decompress jpegs and create a raw bitmap version of the image. In jpeg_decoder_initialize, the values for cinfo.output_width and cinfo.output_height are retrieved directly from a jpeg file's header. cinfo.output_width and cinfo.output_height can be manipulated by editing the header of the jpeg file being processed. They are two bytes each in the image's header so their values can range from 0x0000 to 0xFFFF. These variables are multiplied with frame.bpp. When these three values are multiplied together they can exceed the limit of a 32-bit unsigned integer, leading to an integer overflow vulnerability. This product is used to set the size of the image_data buffer, which will store the decompressed jpeg (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.…) When the sizing arguments overflow, the buffer becomes too small to store the decompressed data. The program writes the decompressed image to the buffer using the jpeg_read_scanlines function. The function ends up writing to out-of-bounds memory due to the buffer’s small size (https://github.com/wine-mirror/wine/blob/master/dlls/windowscodecs/libjpeg.…) This causes data in memory adjacent to the buffer to be overwritten. An attacker is in control of the image's height, width, and contents. This allows an attacker to craft an exploit to overwrite data in memory with data they control. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 59692] New: WoW MoP PTR unable to launch because it fails to load function IPHLPAPI.dll
by WineHQ Bugzilla May 1, 2026

May 1, 2026

http://bugs.winehq.org/show_bug.cgi?id=59692 Bug ID: 59692 Summary: WoW MoP PTR unable to launch because it fails to load function IPHLPAPI.dll Product: Wine Version: 11.7 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: iphlpapi Assignee: wine-bugs(a)list.winehq.org Reporter: macieklin16(a)gmail.com Distribution: --- Created attachment 80802 --> http://bugs.winehq.org/attachment.cgi?id=80802 PROTON_LOG I'm having annoying issue with MoP PTR in particular (all other versions run just fine, including other PTR). The client straight up crashes with said error. I've been said on CachyOs discord server that that funcion is stub, But i'm not that tech savvy so it would point me in any direction. My specs: 9800x3d paired with rtx 5080 Environmental variables: WINE_SIMULATE_WRITECOPY=1 PROTON_USE_NTSYNC=1 MANGOHUD=1 Things I've tried so far: - switching to various proton versions (GE,CachyOs,provided by steam, basically all of them) - gemini pointed me towards changing version of windows in Winecfg but that didn't help at all - adding an override to IPHLPAPI.dll - running directly through terminal using "wine start" command All of these steps didn't even change the error output that I get, while other versions where running fine despite changes. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6

Jump to page: