A heap out-of-bounds write vulnerability in AcademySoftwareFoundation OpenImageIO allows for potential memory corruption when processing malicious IFF image files.

This is an out-of-bounds write (CWE-787) flaw within the IffInput::read_native_tile function. It is triggered when an attacker provides a specially crafted IFF file that causes a buffer size mismatch between the 16-bit image specification and the 32-bit internal pixel decoder, requiring no authentication but user interaction to process the malicious file.

The vulnerability carries a CVSS score of 7.8, reflecting its potential to cause system instability or arbitrary code execution through memory corruption. Successful exploitation could lead to application crashes or unauthorized data manipulation, posing a significant risk to production pipelines in VFX and animation workflows where OpenImageIO is integrated.

Immediate Action: Update OpenImageIO to versions 3.0.21.0, 3.1.16.0, or 3.2.0.3-beta1 to apply the necessary patches in the IffInput processing logic.

Proactive Monitoring: Monitor application crash logs and memory usage patterns for unexpected spikes or segmentation faults that may indicate attempts to exploit heap corruption vulnerabilities.

Compensating Controls: Implement strict file validation and sandboxing for all incoming image files to ensure they conform to expected formats before processing by the library.

Public Exploit Available: No

Given the potential for memory corruption and the availability of a proof-of-concept, administrators should prioritize updating OpenImageIO to the patched versions. Ensuring that all software dependencies are current is essential to maintaining the integrity of image processing workflows and preventing potential exploitation.