CyberRota Analysis
AI-GeneratedOpenEXR versions prior to 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to an out-of-bounds read due to improper handling of crafted uncompressed deep-tile EXR files, potentially leading to denial of service. This issue primarily affects ILP32 builds and should be prioritized by organizations in the motion picture industry or those utilizing OpenEXR for image processing, as it could disrupt workflows and system stability. Users are advised to upgrade to the patched versions 3.2.11, 3.3.13, or 3.4.14 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable on ILP32 builds to an out-of-bounds read. The vulnerability is reached when a crafted uncompressed deep-tile EXR causes the sample-count table size calculation in OpenEXRCore decoding.c to wrap before unpack_sample_table() iterates over the full attacker-controlled tile dimensions, allowing denial of service. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.