CVE-2023-24472 Denial of service in OpenImageIO

What is CVE-2023-24472?

CVE-2023-24472 is a high-severity denial of service vulnerability in Openimageio Openimageio, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide malicious input to trigger this vulnerability.

Weakness: CWE-674

Which versions are affected by CVE-2023-24472?

It affects 1 product.

Products include Openimageio Openimageio.

How do I fix CVE-2023-24472?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-24472 being exploited?

There is no known exploitation of CVE-2023-24472 in the wild and no public exploit code.

Other vulnerabilities in Openimageio Openimageio

• CVE-2024-55192 Memory corruption in n/a Critical 9.8
• CVE-2024-55194 Memory corruption in n/a Critical 9.8
• CVE-2023-42299 Memory corruption in n/a Critical 9.8
• CVE-2022-38143 Memory corruption in OpenImageIO Critical 9.8
• CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder High 8.8

All Openimageio Openimageio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-24472, GHSA-g3hq-jrqw-hw7w, UBUNTU-CVE-2023-24472.