CVE-2022-36354

A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensiti...

CVE-2022-41988

An information disclosure vulnerability exists in the OpenImageIO::decodeiptciim functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-43599

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43597

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This...

CVE-2022-43600

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

CVE-2022-43600

OpenImageIO CVE-2022-43600 affects OpenImageIO v2.4.4.2. The issue is in IFFOutput::close() where xmax=0xFFFF and TypeDesc::UINT16 can trigger a heap buffer overflow, potentially leading to denial of service or arbitrary code execution. Debian and GLSA advisories also reference related OpenImageI...

CVE-2022-41837

An out-of-bounds write vulnerability exists in the OpenImageIO::addexifitemtospec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41639

A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a...

CVE-2022-43598

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This...

CVE-2022-43593

A denial of service vulnerability exists in the DPXOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. An attacker can provide malicious input to trigger this vulnerability...

CVE-2022-43603

A denial of service vulnerability exists in the ZfileOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41981

CVE-2022-41981: OpenImageIO v2.3.19.0 contains a stack-based buffer overflow in the TGA file format parser. A crafted TGA can cause out-of-bounds reads/writes on the process stack, enabling arbitrary code execution. Affected component: OpenImageIO’s TGA parser (targa files). Connected sources cor...

CVE-2022-43595

CVE-2022-43595 is part of OpenImageIO OpenImageIO v2.4.4.2. It describes multiple denial-of-service vulnerabilities in the image output closing functionality, specifically leading to null pointer dereferences when handling ImageOutput and writing .fits files. The connected advisories confirm mult...

CVE-2022-43598

OpenImageIO OpenImageIO v2.4.4.2 contains multiple memory corruption and out-of-bounds issues in the IFFOutput alignment padding path that can lead to arbitrary code execution when m_spec.format is TypeDesc::UINT8 or UINT16. Affected component: IFFOutput (format-dependent padding). Root cause: me...

CVE-2022-43597

CVE-2022-43597 affects OpenImageIO (OpenImageIO v2.4.4.2) via multiple memory corruption vulnerabilities in IFFOutput alignment padding, triggered when m_spec.format is TypeDesc::UINT8. The issue can lead to arbitrary code execution. Public advisories reference affected versions and fixes; remedi...

CVE-2022-36354

CVE-2022-36354 is a heap out-of-bounds read in OpenImageIO’s RLA format parser (master-branch 9aeece7a and v2.3.19.0). A malformed RLA file can cause an out-of-bounds read of heap metadata, potentially leaking sensitive information. Connected advisories confirm practical exposure and publicly ava...

CVE-2022-38143

CVE-2022-38143 is a heap out-of-bounds write vulnerability in OpenImageIO v2.3.19.0 when processing RLE-encoded BMP images. A crafted BMP can write to arbitrary out-of-bounds memory, potentially enabling arbitrary code execution. Public notices confirm the issue exists and provide upgrade paths. ...

CVE-2022-41999

CVE-2022-41999 affects OpenImageIO’s DDS native tile reading in OpenImageIO v2.3.19.0 and v2.4.4.2, enabling DoS via a crafted .dds file. Connected advisories confirm this bug and point to fixes in newer OpenImageIO releases (e.g., GLSA-202305-33 recommending upgrading to OpenImageIO >= 2.4.6....

CVE-2022-41837

CVE-2022-41837 affects the OpenImageIO library (OpenImageIO v2.4.4.2) with an out-of-bounds write in OpenImageIO::add_exif_item_to_spec, causing stack-based memory corruption when processing crafted exif metadata. Exploitation requires a malicious image/file. Public advisories confirm remediation...