CVE-2023-22845 Information disclosure in OpenImageIO

What is CVE-2023-22845?

CVE-2023-22845 is a high-severity vulnerability in Openimageio Openimageio, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

Weakness: CWE-125

Which versions are affected by CVE-2023-22845?

It affects 1 product.

Products include Openimageio Openimageio.

How do I fix CVE-2023-22845?

Upgrade to a fixed version.

Is CVE-2023-22845 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22845 exists.

Other vulnerabilities in Openimageio Openimageio

• CVE-2024-55192 Memory corruption in n/a Critical 9.8
• CVE-2024-55194 Memory corruption in n/a Critical 9.8
• CVE-2023-42299 Memory corruption in n/a Critical 9.8
• CVE-2022-38143 Memory corruption in OpenImageIO Critical 9.8
• CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder High 8.8

All Openimageio Openimageio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-22845, GHSA-x28w-rxm5-x896, UBUNTU-CVE-2023-22845.