OpenEXR Compression Vulnerability Leading to Heap Memory Corruption

A vulnerability exists in the OpenEXR file format when decoding images that use DWAA or DWAB compression. The issue arises from an implicit assumption that the image dimensions are divisible by 8. If they are not, the decoding process can write beyond the allocated buffer, corrupting adjacent heap memory. This vulnerability affects OpenEXR versions prior to 8.0.

Impact

Exploitation of this vulnerability can lead to heap memory corruption, potentially allowing for arbitrary code execution or other memory-related attacks.

Remediation

Users are advised to upgrade to OpenEXR version 8.0 or later.