CVE-2022-41838
Published: 22 December 2022
Summary
CVE-2022-41838 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Openimageio Openimageio. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO v2.4.4.2. A specially crafted .dds file can trigger a heap buffer overflow due to improper bounds checking during scanline processing, classified under CWE-122 and CWE-787. The flaw affects the core image input/output library used by numerous graphics and media applications.
An unauthenticated attacker can supply a malicious .dds file over the network to trigger the overflow, resulting in arbitrary code execution with full confidentiality, integrity, and availability impact. The CVSS 3.1 score of 9.8 reflects the absence of required privileges or user interaction and the network attack vector.
Gentoo and Debian security advisories (GLSA-202305-33 and DSA-5384) address the issue through updated OpenImageIO packages that correct the parsing logic. The Talos report TALOS-2022-1634 provides the underlying technical analysis and proof-of-concept details for verification.
EPSS remains low and unchanged at 0.0598 with no upward trajectory after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45005
Vulnerability details
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.