infamous41md reports:
zgv uses malloc() frequently to allocate memory for storing
image data. When calculating how much to allocate, user
supplied data from image headers is multiplied and/or added
without any checks for arithmetic overflows. We can
overflow numerous calculations, and cause small buffers to
be allocated. Then we can overflow the buffer, and
eventually execute code. There are a total of
11 overflows that are exploitable to execute arbitrary
code.
These bugs exist in both zgv and xzgv.