VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 9, 2020· Updated Aug 4, 2024

CVE-2020-16587

CVE-2020-16587

Description

A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.

Affected products

10

Patches

Vulnerability mechanics

Root cause

"Off-by-one error in bounds check: `partNumber > parts.size()` instead of `partNumber >= parts.size()` allows access at an invalid index."

Attack vector

An attacker crafts a malicious EXR file with a part number in the chunk offset table that equals the number of parts (i.e., an index of `parts.size()`). When `chunkOffsetReconstruction` processes this file, the flawed comparison `partNumber > static_cast<int>(parts.size())` treats the invalid index as valid, leading to a heap-based buffer over-read or over-write. This can cause a denial of service via a crash or potentially more severe memory corruption.

Affected code

The vulnerability is in `OpenEXR/IlmImf/ImfMultiPartInputFile.cpp` in the `MultiPartInputFile::Data::chunkOffsetReconstruction` function. The bounds check for `partNumber` used `>` instead of `>=`, allowing an out-of-bounds index equal to `parts.size()` to pass validation.

What the fix does

The patch changes the comparison from `>` to `>=` on line 574 of `ImfMultiPartInputFile.cpp`. This ensures that a `partNumber` equal to `parts.size()` is correctly rejected as out of range, preventing access beyond the bounds of the `parts` vector. The fix closes the off-by-one error that allowed the heap buffer overflow.

Preconditions

  • inputThe attacker must supply a crafted EXR file that sets a part number in the chunk offset table equal to the total number of parts declared in the file.
  • configThe victim application must use a vulnerable version of OpenEXR (2.3.0) to open the malicious file.

Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.