CVE-2023-5841

Name of the Vulnerable Software and Affected Versions Academy Software Foundation OpenEXR image parsing library versions 3.2.1 and prior

Description The issue is caused by a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, leading to a heap-based buffer overflow. This allows a remote attacker to read or write arbitrary data. The vulnerability was resolved in versions v3.2.2 and v3.1.12 of the affected library.

Recommendations For versions 3.2.1 and prior, update to version v3.2.2 or v3.1.12 to resolve the issue. As a temporary workaround, consider restricting the use of OpenEXR files containing deep scanline data until a patch is available.