CVE-2018-7730

Vulnerability

Exempi through version 2.4.4 contains a heap-based buffer over-read vulnerability in the PSD_MetaHandler::CacheFileData() function, triggered when XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp mishandles a length value of 0xffffffff [1][2]. This can occur when processing a crafted Adobe Photoshop PSD or similar file containing a malformed Image Resource Block (IRB) or Photoshop Image Resources (PSIR) data. The affected versions include all releases up to and including 2.4.4.

Exploitation

An attacker can exploit this issue by supplying a specially crafted file that, when parsed by an application using Exempi (such as a thumbnailer or metadata extractor), triggers the vulnerable code path. No authentication or special privileges are required; the attack vector is local or remotely via file download. The mishandling of the 0xffffffff length leads to a heap buffer over-read, potentially exposing sensitive heap memory contents.

Impact

A successful exploit can result in a heap-based buffer over-read, which may lead to information disclosure (confidentiality impact) by leaking heap data, or cause a crash (availability impact). The CVSS v3 score is 6.5 (Medium) [1], indicating a moderate severity with high attack complexity but no privileges required. There is no evidence of code execution or privilege escalation.

Mitigation

Red Hat released an update in RHSA-2019:2048 (2019-08-06) for Red Hat Enterprise Linux 7 [1]. Fedora and other distributions have also provided fixed versions; users should upgrade to a patched release (e.g., exempi-2.5.0 or later) when available. No workaround is documented; the only mitigation is to apply the vendor-supplied patch.