CVE-2022-41837

CVE-2022-41837 affects the OpenImageIO library (OpenImageIO v2.4.4.2) with an out-of-bounds write in OpenImageIO::add_exif_item_to_spec, causing stack-based memory corruption when processing crafted exif metadata. Exploitation requires a malicious image/file. Public advisories confirm remediation...

CVE-2022-41837

An out-of-bounds write vulnerability exists in the OpenImageIO::addexifitemtospec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41988

CVE-2022-41988 describes an information disclosure in OpenImageIO’s decode_iptc_iim() for OpenImageIO v2.3.19.0. A specially-crafted TIFF can disclose sensitive information. Connected sources corroborate this OpenImageIO information disclosure vulnerability and tie it to multiple advisories acros...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-41981

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-41684

A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a...

CVE-2022-38143

CVE-2022-38143 is a heap out-of-bounds write vulnerability in OpenImageIO v2.3.19.0 when processing RLE-encoded BMP images. A crafted BMP can write to arbitrary out-of-bounds memory, potentially enabling arbitrary code execution. Public notices confirm the issue exists and provide upgrade paths. ...

CVE-2022-41999: NULL Pointer Dereference

A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2022-41981: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger...

CVE-2022-41684: Out-of-bounds Read

A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a...

OpenImageIO heap out-of-bounds read vulnerability

OpenImageIO is an image read and write library that also provides several tools and applications. openImageIO is vulnerable to a heap out-of-bounds read vulnerability. An attacker can exploit this vulnerability to read heap metadata out of bounds via specially crafted RLA files, which can lead to...

CVE-2022-43599: Heap-based Buffer Overflow

Multiple code execution vulnerabilities exist in the IFFOutput::close functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability...

OpenImageIO Out-of-Bounds Write Vulnerability

OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an out-of-bounds write vulnerability, which is caused by an out-of-bounds write flaw in the OpenImageIO::addexixitemtospec function. An attacker could use this vulnerability to...

OpenImageIO Information Disclosure Vulnerability (CNVD-2023-55386)

OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an information disclosure vulnerability caused by an out-of-bounds read flaw in the OpenImageIO::decodeiptciim function. An attacker can exploit this vulnerability to obtain sensiti...

OpenImageIO Information Disclosure Vulnerability

OpenImageIO is an image read/write library, along with a number of tools and applications. OpenImageIO suffers from an information disclosure vulnerability that is caused by a flaw in the IFFOutput channel interleaving function. An attacker can exploit this vulnerability to obtain sensitive...

OpenImageIO Out-of-Bounds Read Vulnerability

OpenImageIO is an image read/write library, along with a number of tools and applications. An out-of-bounds read vulnerability exists in OpenImageIO. The vulnerability is caused due to an out-of-bounds read vulnerability when processing string fields in TIFF image files. An attacker can exploit...

CVE-2022-41639: Heap-based Buffer Overflow

A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a...

CVE-2022-41649: Out-of-bounds Read

A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file can cause a read of adjacent heap memory, which can leak sensitive process information. An attacker can provide a malicious file to trigger...

CVE-2022-41794: Heap-based Buffer Overflow

A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...