CVE-2022-41794

2022-12-2200:00:00

CWE-122

talos

www.cve.org

heap buffer overflow

openimageio

psd file

arbitrary code execution

vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.2%

JSON

A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

CNA Affected

[
  {
    "vendor": "OpenImageIO Project",
    "product": "OpenImageIO",
    "versions": [
      {
        "version": "master-branch-9aeece7a",
        "status": "affected"
      },
      {
        "version": "v2.3.19.0",
        "status": "affected"
      }
    ]
  }
]