Description
Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers can supply a crafted multi-part EXR file whose later part headers bypass ReadAttribute() bounds checks, crashing applications or leaking adjacent heap memory into attribute values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
syoyo tinyexr
Default version status: unaffected
0 to ≤ 3.2.0affected
pkg:github/syoyo/tinyexrReferences
- https://hackmd.io/@haind-pwn/tinyexr-multipart-header-stale-size-oob-read ↗
- https://github.com/syoyo/tinyexr/blob/6f470c9ab24bf3992bc512ce07e8ecb00d9bf105/tinyexr.h#L10551-L10621 ↗
- https://github.com/syoyo/tinyexr/blob/6f470c9ab24bf3992bc512ce07e8ecb00d9bf105/tinyexr.h#L1207-L1266 ↗
- https://www.vulncheck.com/advisories/tinyexr-through-3.2.0-heap-out-of-bounds-read-via-parseexrmultipartheaderfrommemory ↗