CyberRota Analysis
AI-GeneratedOpenEXR versions prior to 3.2.11, as well as 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, are vulnerable to crashes when processing specially crafted EXR files with empty multiView header attributes, leading to potential disruptions in workflows that rely on this image format. This vulnerability primarily affects users in the motion picture industry who utilize OpenEXR for image processing. Organizations using affected versions should prioritize upgrading to the patched releases (3.2.11, 3.3.13, or 3.4.14) to mitigate the risk of crashes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile() processes a crafted EXR with an empty multiView header attribute and Imf::viewFromChannelName() indexes the empty vector for a dotless channel name. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.