CVE-2023-22291

An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can lead to an attempt to free a stack pointer, which causes memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

Weakness

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

Affected Software

Potential Mitigations

• Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
• For example, glibc in Linux provides protection against free of invalid pointers.

References

• https://jvn.jp/en/jp/JVN79149117/
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1687