PT-2022-6801 · Unknown+2 · Openimageio+2

Lilith >_> · Published 2022-10-19 · Updated 2025-06-23 · CVE-2022-41977

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenImageIO version v2.3.19.0

Description An out of bounds read issue exists in the way OpenImageIO processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this issue.

Recommendations For OpenImageIO version v2.3.19.0, consider avoiding the use of TIFF image files until a patch is available. As a temporary workaround, restrict access to the image processing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2022-3225

ALT-PU-2025-6890

BDU:2023-04795

CVE-2022-41977

DLA-3382-1

DSA-5384-1

MGASA-2023-0151

OPENSUSE-SU-2024:12477-1

Affected Products

Alt Linux

Astra Linux

Openimageio

References · 37

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-41977 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41977 · Security Note
• https://ubuntu.com/security/CVE-2022-41977 · Vendor Advisory
• https://debian.org/security/2023/dsa-5384 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12477-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04795 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41977 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0151.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-41977 · Vendor Advisory
• https://debian.org/lts/security/2023/dla-3382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41977 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0151 · Vendor Advisory