CVE-2022-41981: Buffer Overflow
Published Dec 22, 2022
·Updated
A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
3 affected componentsFixes available
debian/openimageio<=2.0.5~dfsg0-1
2.0.5~dfsg0-1+deb10u22.2.10.1+dfsg-1+deb11u12.4.7.1+dfsg-22.4.14.0+dfsg-1
Openimageio Openimageio=2.3.19.0
Debian Debian Linux=11.0
Event History
Dec 22, 2022
CVE Published
10:15 PM
Dec 23, 2022
CVE Published
via MITRE·11:03 PM
Data Sourced
via MITRE·11:03 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-41981.
2
What is the severity of CVE-2022-41981?
The severity of CVE-2022-41981 is high.
3
What is the affected software?
The affected software is OpenImageIO v2.3.19.0 and Debian Linux 11.0.
4
How does the vulnerability in OpenImageIO v2.3.19.0 occur?
The vulnerability in OpenImageIO v2.3.19.0 occurs due to a stack-based buffer overflow in the TGA file format parser.
5
What is the risk of CVE-2022-41981?
The risk of CVE-2022-41981 is arbitrary code execution.