CVE-2022-43597 - Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Back Back to CVE browser

HIGH

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2

Published Dec 23, 2022

8.1

HIGH

CVSS 3.1

EPSS 1.91%

Description

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT8`.

Affected products

Vendor OpenImageIO Project Product OpenImageIO Default
n/a
- Version
  v2.4.4.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

OpenImageIO Project

OpenImageIO

n/a

Version	Status	Constraints
v2.4.4.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-122

References (3)

https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655
ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384
Third Party Advisory

Link	Providers	Tags
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655		ExploitThird Party Advisory
https://www.debian.org/security/2023/dsa-5384		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Dec 23, 2022

Updated Apr 15, 2025

Reserved Oct 21, 2022

Link CVE-2022-43597

CISA Vulnrichment

Updated Apr 15, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-43597

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-43597