CVE-2022-43602

Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT8`

Score
CVSS 3.1 8.1 High
Status
Modified - talos-cna@cisco.com
Published
2022-12-22
Last modified
2025-04-14
Weaknesses
CWE-122

Affected products

References