CVE-2022-41837 Memory corruption in OpenImageIO
An attacker can trigger stack-based memory corruption via malicious EXIF metadata, potentially leading to code execution in applications using OpenImageIO.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41837?
CVE-2022-41837 is a critical memory corruption vulnerability in Debian Debian Linux, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
Which versions are affected by CVE-2022-41837?
It affects 2 products.
Products include Debian Debian Linux, Openimageio Openimageio.
How do I fix CVE-2022-41837?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-41837 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41837 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-41837, GHSA-2hg4-4q69-pf8q, UBUNTU-CVE-2022-41837.