A memory exhaustion flaw exists in the PNG decoder of Sliver’s HTTP(S) listener. By submitting a maliciously compressed PNG whose dimensions are accepted without a decoded‑size or pixel limit, an attacker can force the server’s png.Decode routine to inflate the image data. The result is a rapid depletion of heap memory that crashes the process, making the C2 channel unavailable to legitimate users. The issue is exploitable without authentication, causing total loss of availability of the compromised listener.

BishopFox Sliver versions earlier than 1.7.6, specifically the HTTP(S) listener implementation that uses the PNG encoder in util/encoders/images.go and the nonce space in server/encoders/encoders.go. Any instance of Sliver deployed with this listener that accepts externally generated PNG payloads is vulnerable.

The CVSS score of 8.2 indicates a high severity. EPSS is not available, so the current exploitation probability cannot be quantified, but the flaw permits unauthenticated remote exploitation once a valid nonce is discovered. The vulnerability is not listed in the CISA KEV catalog. Attackers could trigger the memory exhaustion by remotely submitting a crafted PNG to the listener, provided they can identify the nonce, which the server’s small nonce space allows to be determined over the network.