CVE-2023-50245

OpenEXR-viewer memory overflow vulnerability

CVSS 9.8 CRITICALEPSS 1.1%CWE-120

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 1.1%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

11 Dec 2023Published on NVD

21 Aug 2024Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

afichet · openexr-viewer

public PoCs found — 1

githubgithub.com/200101WhoAmI/CVE-2023-50245★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/afichet/openexr-viewer/commit/d0a7e85dfeb519951fb8a8d70f73f30d41cdd3d9 https://github.com/afichet/openexr-viewer/security/advisories/GHSA-99jg-r3f4-rpxj