OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

Vulnerability

Overview

In OpenEXR version 3.3.2, the ScanLineProcess::run_fill function in ImfDeepScanLineInputFile.cpp writes the fill value into a sample buffer without confirming the buffer is allocated [1][4]. When reduceMemory mode is enabled, a check on the total sample size can skip reading pixel data, leaving the sample buffer as a NULL pointer [4].

Exploitation

An attacker can provide a crafted EXR file containing a deep scanline image with a large sample count. Running the exrcheck tool with the -m flag (reduceMemory mode) on this file triggers a write operation through the NULL pointer, causing a crash [3][4]. No special authentication is required beyond the ability to load the malformed image.

Impact

Successful exploitation results in a denial-of-service condition—the application crashes due to a NULL pointer dereference in a write operation [1][4]. The attacker cannot achieve code execution or data exfiltration based on the available information.

Mitigation

The vulnerability is fixed in OpenEXR version 3.3.3 [1][2]. Users should update to the latest version. If immediate upgrade is not possible, avoid processing untrusted EXR files in reduceMemory mode as a workaround.

For further details, see the official advisory [4] and proof-of-concept [3].