CVE-2023-3430: openimageio Heap-based Buffer Overflow
Vulnerability summary
CVE-2023-3430 is a high (CVSS 7.5) Heap-based Buffer Overflow vulnerability in openimageio. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-12-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, leading to a denial of service.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.24%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.24% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpenimageio
Maturity: poc
Weaknesses
CWE · root cause- CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Debian1 product
- openimageioAll versions (No fix recorded) | < 2.4.13.0+dfsg-1
Openimageio1 product
- openimageio2.4.11
Ubuntu1 product
- openimageioAll versions (No fix recorded)
3 vendors · 3 products
