CyberRota Analysis
AI-GeneratedOpenEXR versions 3.2.0 to 3.2.10, 3.3.0 to 3.3.12, and 3.4.0 to 3.4.13 are vulnerable to a heap out-of-bounds read due to improper handling of RLE-compressed EXR files, which can lead to denial of service. This vulnerability primarily affects ILP32 builds and poses a risk to organizations in the motion picture industry that utilize OpenEXR for image processing. Users of the affected versions should prioritize upgrading to the fixed releases (3.2.11, 3.3.13, or 3.4.14) to mitigate potential disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.2.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. The issue occurs when a crafted RLE-compressed EXR causes the 64-bit unpacked size to truncate before allocation in OpenEXRCore decoding.c and unpack_32bit() reads beyond the resulting buffer, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.