CVE-2022-43603
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO...
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-43603- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2022-46599
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
EUVD-2022-46599- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-245j-8gjp-c4v5
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO...
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
GHSA-245j-8gjp-c4v5- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-43603- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
CVE-2022-43603- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-43603
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
DEBIAN-CVE-2022-43603- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-43603
A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability.
- Record
UBUNTU-CVE-2022-43603- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2023-0151 No score
Updated openimageio packages fix security vulnerability
A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. (CVE-2022-36354)
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. (CVE-2022-38143)
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of bounds memory corruption, which can result in arbitrary code execution. (CVE-2022-41639)
A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. (CVE-2022-41684)
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. (CVE-2022-41794)
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. (CVE-2022-41838)
An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. (CVE-2022-41977)
A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. (CVE-2022-41981)
An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. (CVE-2022-41988)
A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-crafted .dds can lead to denial of service. (CVE-2022-41999)
An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. (CVE-2022-43592)
A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to null pointer dereference. (CVE-2022-43593)
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. This vulnerability applies to writing .bmp files. (CVE-2022-43594)
Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. This vulnerability applies to writing .fits files. (CVE-2022-43595)
An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to leaked heap data. (CVE-2022-43596)
Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to arbitrary code execution. This vulnerability…
- Record
MGASA-2023-0151- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12589-1 No score
OpenImageIO-2.4.6.0-1.1 on GA media
These are all security issues fixed in the OpenImageIO-2.4.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12589-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openimageioDebian:12 |
before 2.4.7.1+dfsg-2 | 2.4.7.1+dfsg-2 |
openimageioDebian:13 |
before 2.4.7.1+dfsg-2 | 2.4.7.1+dfsg-2 |
openimageioDebian:14 |
before 2.4.7.1+dfsg-2 | 2.4.7.1+dfsg-2 |
openimageioDebian:10 |
before 2.0.5~dfsg0-1+deb10u1, plus listed versions 2.0.5~dfsg0-1 |
2.0.5~dfsg0-1+deb10u1 |
openimageioDebian:11 |
before 2.2.10.1+dfsg-1+deb11u1, plus listed versions 2.2.10.1+dfsg-1 |
2.2.10.1+dfsg-1+deb11u1 |
openimageioMageia:8 |
before 2.2.10.0-1.1.mga8 | 2.2.10.0-1.1.mga8 |
openimageioUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.5.17~dfsg0-1ubuntu21.5.20~dfsg0-1ubuntu21.5.23~dfsg0-1ubuntu11.6.9~dfsg0-4ubuntu11.6.10~dfsg0-1ubuntu11.6.10~dfsg0-2ubuntu11.6.11~dfsg0-1ubuntu11.6.11~dfsg0-1ubuntu1+esm2 |
None known |
openimageioUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.6.17~dfsg0-1ubuntu51.7.17~dfsg0-1ubuntu21.7.17~dfsg0-1ubuntu2+esm1 |
None known |
openimageioUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.10~dfsg0-12.0.11~dfsg0-12.0.12~dfsg0-12.0.12~dfsg0-1build12.0.12~dfsg0-1build2 Show 4 moreShow less2.1.10.1~dfsg0-5ubuntu42.1.10.1~dfsg0-5ubuntu52.1.12.0~dfsg0-12.1.12.0~dfsg0-1ubuntu0.1~esm1 |
None known |
openimageioUbuntu:22.04:LTS |
All versions, plus listed versions 2.2.10.1+dfsg-1build12.2.18.0+dfsg-12.2.18.0+dfsg-1build22.2.18.0+dfsg-1ubuntu2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openimageioUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.4.14.0+dfsg-12.4.16.0+dfsg-12.4.16.0+dfsg-1build12.4.17.0+dfsg-12.4.17.0+dfsg-1build12.4.17.0+dfsg-1.1build32.4.17.0+dfsg-1.1build42.4.17.0+dfsg-1.1ubuntu0.1~esm1 |
None known |
openimageioUbuntu:25.10 |
All versions, plus listed versions 2.5.18.0+dfsg-1build12.5.18.0+dfsg-1build2 |
None known |
openimageioUbuntu:26.10 |
All versions, plus listed versions 2.5.19.1+dfsg-22.5.19.1+dfsg-2build12.5.19.1+dfsg-2build2 |
None known |
openimageioUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.5.18.0+dfsg-1build22.5.19.1+dfsg-1build12.5.19.1+dfsg-1build32.5.19.1+dfsg-1build52.5.19.1+dfsg-22.5.19.1+dfsg-2ubuntu0.1~esm1 |
None known |
OpenImageIOopenSUSE:Tumbleweed |
before 2.4.6.0-1.1 | 2.4.6.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43603 is a medium vulnerability (CVSS 5.9) in Academysoftwarefoundation Openimageio, published December 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in openimageio 2.4.7.1+dfsg-2.
References
talosintelligence.com/vulnerability_reports/TALOS-2022-1657
debian.org/security/2023/dsa-5384
security.gentoo.org/glsa/202305-33
nvd.nist.gov/vuln/detail/CVE-2022-43603
lists.fedoraproject.org/archives/list/[email protected]/message/MLUXEL7AB2S5ACSDCHG67GEZHUYZBR5O
github.com/advisories/GHSA-245j-8gjp-c4v5
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2022-43603
advisories.mageia.org/MGASA-2023-0151.html
bugs.mageia.org/show_bug.cgi?id=31364
ubuntu.com/security/CVE-2022-43603
cve.org/CVERecord?id=CVE-2022-43603
suse.com/security/cve/CVE-2022-43592
Left out here: the rest of 1 source description. The JSON record has them.