Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-43598: OpenImageIO: Malicious Image Data Can Execute Arbitrary Code

CVE-2022-43598 · published 3 years ago

Summary

A vulnerability in OpenImageIO's image processing software allows an attacker to create a specially crafted image that can execute malicious code on your system. This could potentially allow an attacker to take control of your system. Update to the latest version of OpenImageIO to protect against this vulnerability.

What to do

Update debian openimageio to version 2.4.7.1+dfsg-2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:16.04:LTS	canonical	openimageio	All versions
Ubuntu:18.04:LTS	canonical	openimageio	All versions
Ubuntu:20.04:LTS	canonical	openimageio	All versions
Ubuntu:22.04:LTS	canonical	openimageio	All versions
Ubuntu:24.04:LTS	canonical	openimageio	All versions
Ubuntu:25.10	canonical	openimageio	All versions
Ubuntu:26.04	canonical	openimageio	All versions
–	openimageio	openimageio	2.4.4.2 `cpe:2.3:a:openimageio:openimageio:2.4.4.2:::::::*`
–	debian	debian_linux	11.0 `cpe:2.3:o:debian:debian_linux:11.0:::::::*`
Debian:12	debian	openimageio	< 2.4.7.1+dfsg-2 Fix: upgrade to 2.4.7.1+dfsg-2

Original advisory text

Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `m_spec.format` is `TypeDesc::UINT16`.

References

https://ubuntu.com/security/CVE-2022-43598 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-43598 Third Party Advisory
https://security.gentoo.org/glsa/202305-33 Vendor Advisory
https://www.debian.org/security/2023/dsa-5384 Vendor Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1655 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43598... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-43598 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2022-43598 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

2% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published22 Dec 2022

Updated30 Oct 2026

First seen27 Apr 2026

Sources

UBUNTU-CVE-2022-43598 · OSV

CVE-2022-43598 · NVD

CVE-2022-43598 · OSV

DEBIAN-CVE-2022-43598 · OSV

Track software like this

Free during beta