Product:
OpenEXR
Summary
When decoding an OpenEXR file that uses DWAA or DWAB compression, there is an implicit assumption that all image channels have the same pixel type and size. If there are four channels, the first four are assumed to be B, G, R, and A. This can lead to buffer overflows if the main color channels are set to a 4-byte type while adding duplicate or unknown channels of a 2-byte type.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-59733 |
Exploitation
To exploit this vulnerability, an attacker can craft an OpenEXR file with a specific configuration of channels where the main color channels are of a 4-byte type and additional channels are of a 2-byte type. This configuration can cause the pointer arithmetic in the decoding process to exceed the allocated buffer, leading to potential buffer overflow and arbitrary code execution.
Affected Products
- OpenEXR: Vulnerable when using DWAA or DWAB compression with incorrect channel configurations.
Mitigation
It is recommended to upgrade to version 8.0 or beyond to mitigate this vulnerability. This upgrade addresses the assumptions made during the decoding process and ensures proper handling of different channel types.