OpenImageIO OpenEXR Partial Tile Heap OOB Write (CVE-2025-6342)

Summary of Partial Edge Tile Heap Out-of-Bounds Write Vulnerability in OpenImageIO OpenEXR Plugin Vulnerability Overview Vulnerability Name: OpenImageIO OpenEXR Plugin Partial Edge Tile Heap Out-of-Bounds Write CVE ID: CVE-2025-6342 Severity Level: High (CVSS 3.1 Score 7.8/10) Vulnerability Type: Heap Buffer Overflow (heap-buffer-overflow) Root Cause: In , within , when reading partial edge tiles, the code utilizes a temporarily padded buffer. However, when copying from this temporary buffer to the caller's buffer, OpenImageIO uses the padded stride ( ) instead of the destination stride calculated based on the requested rectangle's width ( ). This causes the destination offset to exceed the expected buffer range, resulting in a heap out-of-bounds write. Scope of Impact Affected Versions: - Vulnerable: OpenImageIO v3.1.14.1, commit - The main branch is also vulnerable as of commit Impact: In applications calling , when the requested OpenEXR tile range exceeds the buffer size (for example, if the requested rectangle is at the right edge of the image with , width of 84 pixels, and expected contiguous output size of bytes), OpenImageIO treats it as a valid range and fills the temporary buffer. When copying to the caller's buffer, the padded stride ( bytes) is used, leading to a heap out-of-bounds write. Remediation Recommended Fix: - For edge tiles, when copying back from the padded temporary buffer to the caller's buffer, the destination stride should be based on the requested rectangle's width ( ), rather than the padded stride. - Add regression tests covering padded OpenEXR tiles where the width is not divisible by the tile width, and where the caller's buffer size is exactly , including canary bytes. - Consider adding explicit tests for to cover edge ranges accepted by . PoC Code Verification Evidence Builds: - v3.1.14.1 non-ASAN: The generic reproducer reports double-free or corruption (out). The canary checker reports - v3.1.14.1 ASAN: , , , symbolized to - v3.1.14.1 UBSAN non-ASAN: The generic reproducer reports double-free or corruption (out). The canary checker reports the same - main non-ASAN: Same , , , symbolized to Non-ASAN Canary Output: Full ASAN Log (v3.1.14.1): ``` ==214329==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x52f00054c100 at pc 0x52f00054c100 bp 0x7fff... WRITE of size 756 at 0x52f00054c100 thread T0 #0 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #1 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #2 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #3 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #4 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #5 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #6 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #7 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #8 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #9 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #10 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #11 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #12 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #13 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #14 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #15 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #16 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #17 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #18 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #19 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #20 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #21 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #22 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #23 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/asan/ol10_exr_partial_tile_harness+0x10047) #24 0x52f00054c100 (/home/brizu/OpenImageIO/v3.1.14.1/uzz/fuzz/

Goal Reached Thanks to every supporter — we hit 100%!

OpenImageIO OpenEXR Partial Tile Heap OOB Write (CVE-2025-6342)

More from this source