Lucene search

China National Vulnerability DatabaseCNVD-2023-01790

HistoryDec 23, 2022 - 12:00 a.m.

OpenImageIO Code Execution Vulnerability (CNVD-2023-01790)

2022-12-2300:00:00

China National Vulnerability Database

www.cnvd.org.cn

openimageio

iffoutput

code execution

vulnerability

heap buffer overflow

imageoutput object

xmax

m_spec.format

typedesc::uint8

cnvd-2023-01790

0.005 Low

EPSS

Percentile

76.2%

JSON

A code execution vulnerability exists in the OpenImageIO IFFOutput::close() function, which is an image read/write library that also provides tools and applications. An attacker can use this vulnerability to cause a heap buffer overflow via a specially crafted ImageOutput object (when the “xmax” variable is set to 0xFFFF and “m_spec.format” is “typeDesc::UINT8”).

CPENameOperatorVersion
openimageio openimageio 2.eq4.4.2

CPE	Name	Operator	Version
	openimageio openimageio 2.	eq	4.4.2

0.005 Low

EPSS

Percentile

76.2%

JSON

Related for CNVD-2023-01790