A memory corruption flaw exists in ACDSee Pro. The program fails to sanitize user-supplied input when an error occurs in IDE_ACDStd.apl resulting in memory corruption. When allocating memory based on values in the Logical Screen Descriptor structure of a GIF image, a context-dependent attacker can execute arbitrary code.
Classification
Location:
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Public
Disclosure:
Coordinated Disclosure
Solution
Upgrade to version 5.2 (Build 157) or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
