Product:
OpenEXR
Summary
When decoding an OpenEXR file that uses DWAA or DWAB compression, the specified raw length of run-length-encoded data is not checked when calculating the output data. This can lead to accessing entries in the buffer beyond its allocated size, potentially causing a buffer overflow. It is recommended to upgrade to version 8.0 or beyond to mitigate this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-59731 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious OpenEXR file that contains specially designed run-length-encoded data. By manipulating the rle_raw_size value, the attacker can cause the application to read beyond the allocated buffer, leading to potential arbitrary code execution or crashes.
Affected Products
- OpenEXR: A file format used for high dynamic range images, vulnerable when using DWAA or DWAB compression.
Mitigation
Upgrading to version 8.0 or later of OpenEXR is the recommended mitigation to address this vulnerability. This update includes checks for the raw length of run-length-encoded data, preventing potential buffer overflows.