PT-2022-6799 · Unknown +2 · Openimageio +2

Lilith >_>

·

Published

2022-10-19

·

Updated

2025-06-23

·

CVE-2022-41639

Report an issue
CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

OpenImageIO versions master-branch-9aeece7a through v2.3.19.0

Description:

A heap-based buffer overflow vulnerability exists in the tile decoding code of the TIFF image parser. This issue can be triggered by a specially-crafted TIFF file, leading to out-of-bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a malicious file to exploit this vulnerability, potentially allowing remote access to confidential data, disrupting data integrity, and causing a denial of service.

Recommendations:

For OpenImageIO versions master-branch-9aeece7a through v2.3.19.0, consider disabling the TIFF image parser until a patch is available to prevent exploitation. Restrict access to the tile decoding code to minimize the risk of arbitrary code execution. Avoid using the vulnerable TIFF image parser with untrusted files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122CWE-787

Related Identifiers

ALT-PU-2025-6890
BDU:2023-04793
CVE-2022-41639
DLA-3382-1
DSA-5384-1
MGASA-2023-0151
OPENSUSE-SU-2024:12477-1

Affected Products

Alt Linux
Astra Linux
Openimageio