Heap Buffer Overflow Vulnerability in Grok Package
Summary
OSV-2026-1095: Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData. Affects grok versions >= 06c96bfbc38c74d386ce27018002d3febfff8f0c, < 553b008061c8fafcb161ae293f489e08abf2e2d1. Fixed in 553b008061c8fafcb161ae293f489e08abf2e2d1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grok is an open-source image compression library that provides efficient algorithms for compressing and decompressing image data. It is widely used in various applications for its performance and reliability. However, like many software libraries, Grok is susceptible to vulnerabilities that can compromise its functionality and security. The recent discovery of a heap buffer overflow in the CodeblockDecompressImpl::parsePacketData function poses a significant risk to users of this package.
Vulnerability Detail
The vulnerability identified is a heap buffer overflow that occurs in the grk::t1::CodeblockDecompressImpl::parsePacketData function. This issue arises when the function attempts to read data beyond the allocated memory buffer, which can lead to crashes or potentially allow attackers to execute arbitrary code. The vulnerability was reported through OSS-Fuzz, highlighting its critical nature and the need for immediate attention. The crash state indicates that the overflow happens during the parsing of packet data, making it essential for developers to address this flaw promptly.
How To Fix
Minimum fixed version
553b008061c8fafcb161ae293f489e08abf2e2d1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected function until they have updated to the patched version. This may involve modifying their code to bypass calls to CodeblockDecompressImpl::parsePacketData or implementing additional checks to validate input data before processing.
Conclusion
The heap buffer overflow vulnerability in the Grok package poses a significant risk to users, necessitating immediate action to update to the patched version. By following the provided steps, developers can secure their applications against potential exploits. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for grok →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, which can lead to data corruption, crashes, or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The primary risks include application crashes and potential exploitation by attackers to execute arbitrary code, which can compromise the security of the system using the Grok package.
While the best solution is to update to the patched version, users can temporarily avoid using the affected function and implement input validation to reduce risk.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the GitHub repository for the Grok package.
References
Related vulnerabilities
Recent vulnerabilities recorded for grok.
