CVE-2022-41977 Information disclosure in OpenImageIO

What is CVE-2022-41977?

CVE-2022-41977 is a medium-severity vulnerability in Openimageio Openimageio, published on 23 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

Weakness: CWE-125

Which versions are affected by CVE-2022-41977?

It affects 1 product.

Products include Openimageio Openimageio.

How do I fix CVE-2022-41977?

Upgrade to a fixed version.

Is CVE-2022-41977 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41977 exists.

Other vulnerabilities in Openimageio Openimageio

• CVE-2024-55192 Memory corruption in n/a Critical 9.8
• CVE-2024-55194 Memory corruption in n/a Critical 9.8
• CVE-2023-42299 Memory corruption in n/a Critical 9.8
• CVE-2022-38143 Memory corruption in OpenImageIO Critical 9.8
• CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder High 8.8

All Openimageio Openimageio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-41977, GHSA-ph8f-7wjw-g922, UBUNTU-CVE-2022-41977.