OpenEXRUtil Heap OOB Write Vulnerability Analysis

OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write Vulnerability Overview Vulnerability Type: Heap Out-of-Bounds (OOB) Write Description: A specially crafted EXR file containing a non-zero can cause the API in OpenEXRUtil to return an invalid heap pointer. When the application loads this file and attempts to write a row via , the original v3.4.12 version crashes with SIGSEGV, while an ASAN build reports a write to invalid/freed memory. Root Cause: - The documentation for in specifies it as a 0-based row access. - returns . - adjusts based on for absolute coordinate pixel access. - These models conflict. uses EXR pixel coordinates, but is documented as 0-based. For non-zero , points outside the allocated storage. Impact Scope Affected Versions: - 2. - 3.0. - 3.1. - 3.2.0-3.2.10 - 3.3.0-3.3.12 - 3.4.0-3.4.13 Fixed Versions: - 3.2.11 - 3.3.13 - 3.4.14 CVSS Score: 7.1/10 (High) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: High Remediation Fix**: Upgrade to version 3.2.11, 3.3.13, or 3.4.14 and later. POC Code Verification Steps 1. Run the following commands from the root directory of the OpenEXR v3.4.12 repository: 2. Expected Results: - - - - ASAN Log Excerpt Impact This is a heap memory corruption vulnerability reachable from untrusted EXR files when downstream code performs the final pixel write using OpenEXRUtil's documented row API. Confirmed impacts include SIGSEGV in the original binary and invalid/freed heap writes confirmed by ASAN. Affected consumers include tools, converters, rendering pipeline components, or image processing services that accept untrusted EXR files and load images using .

Goal Reached Thanks to every supporter — we hit 100%!

OpenEXRUtil Heap OOB Write Vulnerability Analysis

More from this source