CVE-2023-24472

Name of the Vulnerable Software and Affected Versions OpenImageIO version 2.4.7.1

Description A denial of service issue exists in the FitsOutput::close() functionality of OpenImageIO, related to uncontrolled recursion. This can be triggered by a specially crafted ImageOutput Object, allowing a remote attacker to cause a denial of service with a maliciously created image file. An attacker can provide malicious input to trigger this vulnerability.

Recommendations For OpenImageIO version 2.4.7.1, consider disabling the FitsOutput::close() function until a patch is available to prevent exploitation. Restrict access to the ImageOutput object to minimize the risk of denial of service attacks. Avoid using specially crafted image files that could trigger this issue until the vulnerability is resolved.