PyOpenEXR Heap Buffer Overflow in Prefixed Literal RGB Key Collision

PyOpenEXR prefixed literal RGB key collision heap buffer overflow Vulnerability Overview Vulnerability Type: Heap Buffer Overflow Vulnerability Description: A maliciously crafted EXR file can cause the PyOpenEXR wrapper to allocate a 2D NumPy array for a literal channel (such as ) to serve as the target buffer for decoded RGB channels ( , , and ). The wrapper installs these three RGB slices using , resulting in a 2D buffer underflow. When opening a file with the default , triggers a heap overflow during normal pixel decoding. Affected Versions: 3.3.0-3.3.12, 3.4.0-3.4.13 Fixed Versions: 3.3.13, 3.4.14 Impact Scope Impact: A malformed but publicly accessible EXR file can consume process memory using the default PyOpenEXR reader API. The demonstrated raw method involves overwriting NumPy allocations controlled by the wrapper's decoded pixel target layout, confirmed as a heap buffer overflow write via ASAN builds with sanitizer support, in addition to the raw build. Potential Impact: Any application, pipeline tool, or service that accepts and opens unencrypted EXR files may be affected. This report does not prove arbitrary code execution; however, heap overflow writes within the image decoding path are security-relevant because malicious media can be provided by untrusted parties and decoded by automated asset processing systems. Remediation Fixed Versions: 3.3.13, 3.4.14 Recommendation: The fix should reject literal channel keys that collide with matching RGB/RGBA group keys, or validate that each reused channel entry installs additional slices using the expected RGB/RGBA shape and matching pixel type. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

PyOpenEXR Heap Buffer Overflow in Prefixed Literal RGB Key Collision

More from this source