CVE-2024-40630: HEIF Heap OOB Read in OpenImageIO
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in HeifInput::seeksubimage(). In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the ImageInput APIs. This bug has been addressed in commit 0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40630?
CVE-2024-40630 has a severity rating that indicates potential impact on systems using affected OpenImageIO versions.
How do I fix CVE-2024-40630?
To fix CVE-2024-40630, upgrade to a version of OpenImageIO that is later than 2.5.13.1, which addresses this vulnerability.
What versions of OpenImageIO are affected by CVE-2024-40630?
CVE-2024-40630 affects versions of OpenImageIO up to and including 2.5.13.1.
What type of vulnerability is CVE-2024-40630?
CVE-2024-40630 is a bug in the handling of image files that may lead to unintended behavior.
What steps can I take to mitigate CVE-2024-40630 until I can upgrade?
Until you can upgrade, avoid using affected OpenImageIO features that could trigger the vulnerability and monitor for any available security patches.