Bug 2487553 (CVE-2025-71330)

Summary: CVE-2025-71330 image-size: image-size: Denial of Service via crafted ICNS image buffer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: alcohan, anthomas, anujha, asoldano, bbaranow, bmaxwell, brasmith, bstansbe, cdrage, cochase, dlofthou, dranck, eborisov, ehelms, ggainey, gmalinko, gparvin, istudens, ivassile, iweiss, janstey, jbalunas, jkoehler, jpasqual, juwatts, kaycoth, lball, lchilton, lphiri, mhulan, mosmerov, msvehla, ngough, nmoumoul, nwallace, osousa, pahickey, pberan, pcreech, pdelbell, pesilva, pjindal, pmackay, rchan, rhaigner, rhel-process-autobot, rstancel, rstepani, rushinde, sdawley, sfeifer, smallamp, thjenkin, tmalecek, vdosoudi, veshanka, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in image-size. A remote attacker can exploit this vulnerability by providing a specially crafted ICNS image buffer. This malicious buffer, containing valid magic bytes and a zero-valued entry length, causes an infinite loop in the ICNS parser. This can permanently block the Node.js event loop, leading to a denial of service (DoS) for the affected system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2492672, 2492673, 2492676, 2492677, 2492674, 2492675, 2492678, 2492679    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-10 14:02:43 UTC 
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.