CVE-2023-5841

The vulnerability results from improper validation of the scanline samples count in OpenEXR files containing deep scanline data. When an application processes a specially crafted image file, an incorrect sample count value leads to data being written outside the allocated heap buffer. This is a classic CWE-122/CWE-787 error — heap buffer overflow with the possibility of overwriting adjacent memory areas.

An attacker can cause memory corruption in the process handling the file, which could result in disclosure of sensitive data or arbitrary code execution (RCE) in the application context. The network vector without authentication requirements significantly increases the risk of vulnerability exploitation.

Update the OpenEXR library to version 3.2.2 or newer (in the 3.2.x branch) or to version 3.1.12 or newer (in the 3.1.x branch). Linux distribution users should apply available system package updates. Until the patch is deployed, it is recommended to avoid processing OpenEXR files from untrusted sources.

Academy Software Foundation OpenEXR in versions 3.2.1 and earlier, and in the 3.1.x branch earlier than 3.1.12.