OpenEXR Unvalidated Data Window Size Leading to Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in OpenEXR version 3.3.2. The issue arises because the application trusts unvalidated data window size values from file headers, which can result in excessive memory allocation and performance degradation when processing malicious files. This vulnerability is present in the reference implementation of the EXR file format, used in the motion picture industry.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by stalling the application or exhausting memory, leading to a crash or significant performance degradation.

Reproduction

The vulnerability can be reproduced by compiling the 'exrcheck' binary with AddressSanitizer enabled, and then using it to open a crafted EXR file that exploits the unvalidated data window size. The application will crash, demonstrating the denial-of-service condition.

Remediation

Users can upgrade to OpenEXR version 3.3.3, which addresses this vulnerability.