CVE-2023-5841

A vulnerability was found in the Academy Software Foundation OpenEXR and requires that a malicious EXR file image is parsed by the target device or environment using OpenEXR. This issue occurs due to a failure in validating the number of scanline samples of an OpenEXR file containing deep scanline data, allowing a read or write primitive based on the provided EXR file attributes. This flaw could be used to read or write memory to a compromised device through an attacker-placed EXR image.

The heap-based buffer overflow vulnerability identified in the Academy Software Foundation's OpenEXR image parsing library represents an important security concern due to its potential for severe consequences and wide-reaching impact. By exploiting this vulnerability, attackers can execute arbitrary code or perform unauthorized read/write operations on affected systems. This ability to manipulate system memory poses a significant risk to data integrity, confidentiality, and system stability. Moreover, the vulnerability's presence in a widely-used image parsing library amplifies its severity. The ability to execute such attacks without user interaction, known as a 0-click attack surface, further amplifies the risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.