Listen to this Post
How the CVE Works
The vulnerability occurs in OpenEXRCore when decompressing DWAA-packed scan-line EXR files. The `LossyDctDecoder_execute` function in `internal_dwa_decoder.h` mishandles pointer arithmetic when copying data. The `src` pointer, declared as __m128i, is incremented as if it were a `uint16_t` (by 88), causing an out-of-bounds read when processing malformed chunks. This leads to a heap-based buffer overflow, potentially allowing arbitrary code execution or data leakage.
DailyCVE Form
Platform: OpenEXR
Version: Affects versions with SSE2-enabled DWA decompression
Vulnerability: Heap buffer overflow
Severity: Critical
Date: 2025-04-15
Prediction: Patch expected by 2025-05-10
What Undercode Say
Compile with ASAN clang -fsanitize=address -O2 exrcheck.cpp -o exrcheck Trigger crash ./exrcheck dwadecoder_crash.exr
How Exploit
- Craft a malicious EXR file with malformed DWAA chunks.
- Trigger the overflow via `exrcheck` or other EXR-parsing tools.
- Exploit heap corruption for RCE or data exfiltration.
Protection from this CVE
- Disable SSE2 in builds.
- Apply vendor patch.
- Use ASAN for detection.
Impact
- Remote code execution.
- Memory leakage (ASLR bypass).
- Application crash (DoS).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
