Posted by Ron E on Sep 15libwmf is vulnerable to an integer overflow / undefined behavior condition in multiple code paths. The affected source files (wmf.c, fig.c, svg.c) use left-shift operations on signed integers that shift into the sign bit (e.g., 1 << 31). According to the C standard, shifting a signed integer into the sign bit is undefined behavior and may lead to incorrect values or unexpected execution paths. When a crafted WMF file is processed with tools...