Security readout for executives and security teams
Plain-English summary
CVE-2017-14628 is a heap-based buffer overflow in sam2p 0.49.3 while loading 24-bit PCX images. If sam2p processes untrusted image files, a crafted PCX could plausibly crash the converter or cause memory-corruption impact. The provided sources do not include CVSS, patch details, or active exploitation evidence.
Executive priority
Prioritize this as a targeted risk review if the business accepts image uploads or runs document/image conversion services. It is not supported as an emergency internet-wide issue by the provided sources, but untrusted file-processing pipelines should not leave memory-corruption bugs uncontained.
Technical view
The CVE describes a heap-based buffer overflow in pcxLoadImage24 in in_pcx.cpp within sam2p 0.49.3 PCX handling. The source bundle does not list CWE, affected CPEs, fixed versions, or vendor advisories. Treat exposure as tied to workflows that invoke sam2p against PCX or mixed image inputs.
Likely exposure
Exposure is likely limited to systems where sam2p 0.49.3 is installed and used to convert or inspect user-supplied PCX images. Internet exposure depends on whether a public upload, ticketing, CMS, or batch-conversion pipeline passes files to sam2p.
Exploitation context
The bundle does not show active exploitation, KEV listing, public weaponization, or a confirmed patch. The risk is most relevant where attackers can submit image files to automated conversion workflows. Memory corruption could affect availability and may have broader impact depending on runtime protections and deployment isolation.
Researcher notes
Source evidence is sparse: one CVE description and a GitHub issue reference. No CVSS vector, CWE, CPE, fixed version, or exploitation status is provided. Validation should focus on confirming real sam2p 0.49.3 deployment and whether PCX input can be attacker-controlled.
Mitigation direction
- Inventory systems and containers for sam2p 0.49.3 usage.
- Avoid processing untrusted PCX files with sam2p until vendor guidance is confirmed.
- Run image conversion in a sandboxed, least-privilege environment.
- Restrict public upload paths that can reach sam2p conversion jobs.
- Check upstream sam2p guidance or package maintainers for fixed versions.
Validation and detection
- Confirm whether sam2p is installed in hosts, images, or build pipelines.
- Review upload and conversion workflows for PCX input handling.
- Check logs for sam2p crashes during PCX processing.
- Verify runtime sandboxing around image conversion services.
- Record current sam2p version and package source.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14628 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pts/sam2p/issues/14CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.