OpenEXRUtil Integer Overflow and Uninitialized Pointer Memory Corruption in Image Resize

Vulnerability Overview Vulnerability Name: Integer Overflow and Use of Uninitialized Pointer leading to Invalid Delete in OpenEXRUtil Image Resize Vulnerability Type: Integer overflow, use of uninitialized pointer leading to invalid delete Affected Component: OpenEXRUtil Image::resize() Severity: Low (CVSS v3 base metrics: 0.0 / 10) Vulnerability Description: Integer Overflow: Arithmetic operations on signed integers are used when calculating image dimensions, which may result in overflow. Uninitialized Pointer: In the exception cleanup path, pointers within the array are uninitialized, leading to an attempt to delete uninitialized pointers during cleanup, causing an invalid delete. Conclusion: The vulnerability is confirmed as a memory-safety Denial of Service (DoS) flaw, not a Remote Code Execution (RCE) vulnerability. Recommended remediation priority: DoS / Memory corruption, rather than RCE. Recommended severity: Medium, unless a directly untrusted loading path or reliable pointer/variable control is proven. Impact Scope Affected Versions: 2.1, 3.0, 3.1, 3.2.0-3.2.9, 3.3.0-3.3.11, 3.4.0-3.4.12 Fixed Versions: 3.2.10, 3.3.12, 3.4.13 Remediation Fixes: Fix the integer overflow issue by ensuring appropriate types and checks are used when calculating image dimensions. Initialize pointers in the array to avoid deleting uninitialized pointers during cleanup. POC Code Existing Reproducer: Triggering Data Window: Height Calculation Attempt: AFL-Derived Minimal Input: Hex Dump: Decoded Fuzzer Fields: Reproduction Commands ASAN/UBSAN Public API PoC: Expected Output: AFL-Derived Input: Non-Sanitizer/AFL Instrumented Local Build Check: Observations: Repeatability on Local Runs: Sanitizer Evidence Saved Sanitizer Outputs: Key Excerpts: GDB Evidence GDB against the non-sanitizer/AFL instrumented PoC: Observed Crash: Backtrace: Registers and Instructions at Crash: Explanation: is an uninitialized value selected from . The crash occurs while reading the vptr from this pointer. The next instruction would be an indirect virtual destructor call. The observed value is not derived from the PoC input type. RIP remains at the fault location in ; no control over RIP was observed. RCE Assessment Conclusion: No RCE confirmed. The vulnerability is confirmed as a memory-safety Denial of Service (DoS) flaw, not a Remote Code Execution (RCE) vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

OpenEXRUtil Integer Overflow and Uninitialized Pointer Memory Corruption in Image Resize

More from this source