CVE-2022-41684
MEDIUMOpenImageIO master-branch-9aeece7a - Info Disclosure
Title source: llmDescription
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
References (4)
Core 4
Core References
Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1632
Third Party Advisory
https://www.debian.org/security/2023/dsa-5384
Third Party Advisory
https://security.gentoo.org/glsa/202305-33
Scores
CVSS v3
5.5
EPSS
0.0008
EPSS Percentile
24.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (1)
openimageio/openimageio
2022-09-14
Published
Dec 22, 2022
Tracked Since
Feb 18, 2026