CVE-2022-41684 Memory corruption in OpenImageIO
A heap out-of-bounds read in OpenImageIO allows attackers to cause denial of service via a malicious PSD file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41684?
CVE-2022-41684 is a high-severity memory corruption vulnerability in Openimageio Openimageio, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Weakness: CWE-125
Which versions are affected by CVE-2022-41684?
It affects 1 product.
Products include Openimageio Openimageio.
How do I fix CVE-2022-41684?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-41684 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41684 exists.
Other vulnerabilities in Openimageio Openimageio
Sources
Also known as DEBIAN-CVE-2022-41684, GHSA-3rmp-xjxw-cprh, UBUNTU-CVE-2022-41684.