CVE-2022-41684 — Out-of-bounds Read in Openimageio
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 76.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Latest updateDec 23
Description
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
2GHSA▶
GHSA-3rmp-xjxw-cprh: A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image fil↗2022-12-23
OSV▶
CVE-2022-41684: A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image fil↗2022-12-22
📋Vendor Advisories
1Debian▶
CVE-2022-41684: openimageio - A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-...↗2022
🕵️Threat Intelligence
2Talos▶
Vulnerability Spotlight: OpenImageIO file processing issues could lead to arbitrary code execution, sensitive information leak and denial of service↗2022-12-22
Talos▶
Vulnerability Spotlight: OpenImageIO file processing issues could lead to arbitrary code execution, sensitive information leak and denial of service↗2022-12-22