Listen to this Post
How the CVE Works
The vulnerability occurs in OpenEXR when processing a deep scanline image with a large sample count in `reduceMemory` mode. The `ScanLineProcess::run_fill` function attempts to write a fill value into an unallocated sample buffer due to a missing check. When `reduceMemory` is enabled, the `readDeepScanLine` function skips reading sample data if the buffer size exceeds gMaxBytesPerDeepScanline. This leaves the destination pointer (dest) as NULL, leading to a NULL pointer dereference during the write operation (fillptr
= fillVal</code>), crashing the application. <h2 style="color: blue;">DailyCVE Form</h2> Platform: OpenEXR Version: Affects versions before patch Vulnerability: NULL Pointer Dereference Severity: Critical Date: 2025-04-15 <h2 style="color: blue;">Prediction: Patch expected by 2025-06-30</h2> <h2 style="color: blue;">What Undercode Say</h2> [bash] exrcheck -m runfill_crash.exr ASAN_OPTIONS=detect_leaks=1 ./exrcheck
How Exploit
- Craft a malicious EXR file with excessive sample counts.
- Enable `reduceMemory` mode during processing.
- Trigger NULL dereference via `fillptr[bash]` write.
Protection from this CVE
- Update to patched OpenEXR version.
- Disable `reduceMemory` for untrusted files.
- Validate sample counts before processing.
Impact
- Denial of Service (Application Crash).
- Potential RCE if combined with memory corruption.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
