ANT-2026-H94NCB56 · danbloomberg/leptonica

heap-buffer-overflow medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-H94NCB56: Heap buffer underflow in pixSetBorderVal via negative index from exceeded border size

A heap buffer underflow occurs in pixSetBorderVal when an oversized border value produces a negative index.

Target

Project: Leptonica
Location: pixSetBorderVal()
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-H94NCB56.

Reference: ANT-2026-H94NCB56
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict: true positive
Severity: medium

UPSTREAM FIX

The change that resolved this finding.

diff --git a/src/pix2.c b/src/pix2.c
index ee03443ff..3bbe34b01 100644
--- a/src/pix2.c
+++ b/src/pix2.c
@@ -1547,6 +1547,14 @@ l_uint32  *datas, *lines;
     if (d != 8 && d != 16 && d != 32)
         return ERROR_INT("depth must be 8, 16 or 32 bpp", __func__, 1);
 
+        /* Clamp border values to image dimensions to prevent
+         * negative index calculations (heap buffer underflow).
+         * When bot > h or right > w, bstart/rstart would go negative. */
+    if (top > h) top = h;
+    if (bot > h) bot = h;
+    if (left > w) left = w;
+    if (right > w) right = w;
+
     datas = pixGetData(pixs);
     wpls = pixGetWpl(pixs);
     if (d == 8) {
diff --git a/src/sarray1.c b/src/sarray1.c
index a2c2d64fb..980e3981d 100644
--- a/src/sarray1.c
+++ b/src/sarray1.c
@@ -1414,7 +1414,8 @@ SARRAY  *sa;
 
     for (i = 0; i < n; i++) {
             /* Get the size of the stored string */
-        if ((fscanf(fp, "%d[%d]:", &index, &size) != 2) || (size > (1 << 30))) {
+        if ((fscanf(fp, "%d[%d]:", &index, &size) != 2) ||
+            (size < 0) || (size > (1 << 30))) {
             success = FALSE;
             L_ERROR("error on string size\n", __func__);
             goto cleanup;

https://github.com/DanBloomberg/leptonica/commit/a0ca522b7d48f471c6225b4a4dc0c63463f10843

TIMELINE

Dates from discovery through public reveal.

2026-03-20 Sent to maintainer
2026-03-20 Patch released
2026-03-29 Reported to tracker
2026-05-07 Maintainer acknowledged
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

904045d9bc0a3b2f6373328f2d58720a271071101b875e05c23086126d5e761ee6727f062912872283ec0b2ac505d501c7d37e1e1199e9174306d95337dc8eac

Committed 2026-04-09 11:49 PT

Revealed 2026-08-17 13:03 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-H94NCB56",
  "bug_class": "Heap Buffer Underflow",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:03+00:00",
  "description": "A heap buffer underflow occurs in pixSetBorderVal when an oversized border value produces a negative index.",
  "discovered_at": null,
  "location": "pixSetBorderVal()",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Leptonica",
  "reproduction": null,
  "technical_details": null,
  "title": "Heap buffer underflow in pixSetBorderVal via negative index from exceeded border size",
  "vendor_severity": "medium"
}