CVE-2017-12596

Published: Aug 7, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In OpenEXR 2.2.0, a crafted image causes a heap-based buffer over-read in the hufDecode function in IlmImf/ImfHuf.cpp during exrmaketiled execution; it may result in denial of service or possibly unspecified other impact.

Affected (1)

Products: Openexr: Openexr

Openexr

1 product

Openexr

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openexr Openexr	Version 2.2.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (10)

https://github.com/openexr/openexr/issues/238

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/openexr/openexr/releases/tag/v2.3.0

Source: cve@mitre.org

https://github.com/xiaoqx/pocs/blob/master/openexr.md

Source: cve@mitre.org

ExploitThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html

Source: cve@mitre.org

https://usn.ubuntu.com/4148-1/

Source: cve@mitre.org

https://github.com/openexr/openexr/issues/238