CVE-2022-38143

2022-12-2222:15:13

CWE-123

CWE-787

[email protected]

web.nvd.nist.gov

cve-2022-38143

openimageio

heap out-of-bounds write

bmp images

arbitrary code execution

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.2%

JSON

A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected configurations

Vulners

NVD

Node

openimageioopenimageioRange≤master-branch-9aeece7a

openimageioopenimageioRange≤v2.3.19.0

CPENameOperatorVersion
openimageio:openimageioopenimageioeq2.3.19.0

CPE	Name	Operator	Version
openimageio:openimageio	openimageio	eq	2.3.19.0

CNA Affected

[
  {
    "vendor": "OpenImageIO Project",
    "product": "OpenImageIO",
    "versions": [
      {
        "version": "master-branch-9aeece7a",
        "status": "affected"
      },
      {
        "version": "v2.3.19.0",
        "status": "affected"
      }
    ]
  }
]