CVE-2017-9112 OpenEXR invalid read
An invalid read in OpenEXR can crash applications processing malicious images, requiring an upgrade to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-9112?
CVE-2017-9112 is a medium-severity denial of service vulnerability in Openexr Openexr, published on 21 May 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
Which versions are affected by CVE-2017-9112?
3 open source packages ship an affected version, including openexr and OpenEXR. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
openexr PyPI | All versions | 2.2.1 |
openexr PyPI | All versions | 2.2.1 |
OpenEXR PyPI | All versions | 2.2.1 |
Products include Openexr Openexr.
How do I fix CVE-2017-9112?
Upgrade openexr to 2.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-9112 being exploited?
There is no known exploitation of CVE-2017-9112 in the wild and no public exploit code.
Other vulnerabilities in Openexr Openexr
- CVE-2023-5841 OpenEXR Heap Overflow in Scanline Deep Data Parsing
- CVE-2026-41142 OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API
- CVE-2026-42216 OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion
- CVE-2017-9111 OpenEXR invalid write
- CVE-2017-9113 Memory corruption in n/a
Sources
Also known as DEBIAN-CVE-2017-9112, GHSA-8m57-j273-2qg9, PYSEC-2026-727, UBUNTU-CVE-2017-9112.