CVE-2023-3430 Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp

What is CVE-2023-3430?

CVE-2023-3430 is a high-severity memory corruption vulnerability in Openimageio Openimageio, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2023-3430?

It affects 1 product.

Products include Openimageio Openimageio.

How do I fix CVE-2023-3430?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-3430 being exploited?

There is no known exploitation of CVE-2023-3430 in the wild and no public exploit code.

Other vulnerabilities in Openimageio Openimageio

• CVE-2024-55192 Memory corruption in n/a Critical 9.8
• CVE-2024-55194 Memory corruption in n/a Critical 9.8
• CVE-2023-42299 Memory corruption in n/a Critical 9.8
• CVE-2022-38143 Memory corruption in OpenImageIO Critical 9.8
• CVE-2026-43908 OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder High 8.8

All Openimageio Openimageio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-3430, GHSA-h9m8-8h93-r67x, UBUNTU-CVE-2023-3430.