CVE-2021-45942

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.1.0 through 3.1.3

Description The issue is related to a heap-based buffer overflow in the Imf 3 1::LineCompositeTask::execute function, which can be called from IlmThread 3 1::NullThreadPoolProvider::addTask and IlmThread 3 1::ThreadPool::addGlobalTask. This overflow can potentially allow an attacker to cause a buffer overflow.

Recommendations For OpenEXR versions 3.1.0 through 3.1.3, update to version 3.1.4 or later to resolve the issue. As a temporary workaround, consider disabling the Imf 3 1::LineCompositeTask::execute function until a patch is available.