CVE-2023-24473 Information disclosure in OpenImageIO

What is CVE-2023-24473?

CVE-2023-24473 is a medium-severity vulnerability in Openimageio Openimageio, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability.

Weakness: CWE-125

Which versions are affected by CVE-2023-24473?

It affects 1 product.

Products include Openimageio Openimageio.

How do I fix CVE-2023-24473?

Upgrade to a fixed version.

Is CVE-2023-24473 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24473 exists.

Other vulnerabilities in Openimageio Openimageio

• CVE-2024-55192 Memory corruption in n/a Critical 9.8
• CVE-2024-55194 Memory corruption in n/a Critical 9.8
• CVE-2023-42299 Memory corruption in n/a Critical 9.8
• CVE-2022-38143 Memory corruption in OpenImageIO Critical 9.8
• CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder High 8.8

All Openimageio Openimageio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-24473, GHSA-9r8p-967f-crjr, UBUNTU-CVE-2023-24473.