CVE-2022-43598

2022-12-2200:00:00

CWE-122

talos

www.cve.org

memory corruption

openimageio project

vulnerability

arbitrary code execution

input trigger

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the m_spec.format is TypeDesc::UINT16.

CNA Affected

[
  {
    "vendor": "OpenImageIO Project",
    "product": "OpenImageIO",
    "versions": [
      {
        "version": "v2.4.4.2",
        "status": "affected"
      }
    ]
  }
]