WS-2023-0025
Published:January 29, 2023
Updated:October 07, 2026
A memory overwrite bug was reported by a security researcher in the ConvertToSinglePlane method via the texconv command-line tool when given an invalid height for planar video textures such as NV12. This can be a potential security bug for any clients of the library who follow the same pattern. This issue does not impact use of the DDS texture loader itself, only when combined with "ConvertToSinglePlane" for converting multi-planar video formats. All other functions in the library fail immediately if given images in planar formats.
Affected Packages
directxtex_uwp (NUGET):
Affected version(s) >=2017.11.1.1 <2023.1.31.1Fix Suggestion:
Update to version 2023.1.31.1directxtex_desktop_2019 (NUGET):
Affected version(s) >=2022.5.10.1 <2023.1.31.1Fix Suggestion:
Update to version 2023.1.31.1directxtex_desktop_win10 (NUGET):
Affected version(s) >=2018.11.20.1 <2023.1.31.1Fix Suggestion:
Update to version 2023.1.31.1Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.9
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.1
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
LOW