Listen to this Post
How the CVE Works
The vulnerability occurs in OpenEXRCore when processing ZIPS-packed deep scan-line EXR files. A maliciously crafted chunk header can trigger a heap-based buffer overflow during decompression. The issue stems from insufficient validation in `undo_zip_impl()` within internal_zip.c. The function fails to check if the decompressed data size (actual_out_bytes) exceeds the pre-allocated buffer size (uncompressed_size). When reconstructing bytes via internal_zip_reconstruct_bytes(), an attacker-controlled chunk header with a manipulated `unpacked_size` can overflow the heap buffer, leading to arbitrary code execution.
DailyCVE Form
Platform: OpenEXR
Version: Affects versions < 3.2.0
Vulnerability: Heap overflow
Severity: Critical
Date: 2025-04-15
Prediction: Patch expected by 2025-06-30
What Undercode Say
Compile with ASAN for detection clang -fsanitize=address exrcheck.c -o exrcheck Trigger PoC ./exrcheck heap_overflow.exr
Exploit
- Craft EXR with oversized decompressed chunk.
- Overflow heap buffer via
internal_zip_reconstruct_bytes(). - Potential RCE via controlled write.
Protection from this CVE
- Update to OpenEXR >= 3.2.0.
- Validate
actual_out_bytes <= uncompressed_size. - Use bounds-checked decompression.
Impact
- Arbitrary code execution.
- Memory corruption.
- Application crash (DoS).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
