Heap Out-of-Bounds Read in Tinyexr

Executive Summary

Tinyexr through 3.2.0 has a heap out-of-bounds read vulnerability in the ParseEXRMultipartHeaderFromMemory() function. The issue occurs because a length value (marker_size) is computed once before a loop and never updated while the cursor advances through each part's header. This causes the parser to operate on an oversized window that extends past the actual input buffer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using tinyexr v3.2.0 or earlier for multipart EXR file parsing. Use static analysis tools to check for the stale marker_size issue in ParseEXRMultipartHeaderFromMemory. Monitor for crashes or heap leaks when processing EXR files. Fuzz testing with crafted multipart EXR files can help identify the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

Attackers can supply a crafted multi-part EXR file to trigger this flaw. It may cause application crashes (denial of service) or leak adjacent heap memory into attribute values. The impact is limited to denial of service and information disclosure; no out-of-bounds write or code execution was demonstrated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service and information disclosure by reading beyond allocated memory buffers. It does not directly impact compliance with GDPR or HIPAA unless the affected system processes personal or health data stored in EXR files. If such data is leaked or corrupted due to the vulnerability, it could potentially violate GDPR's data integrity principles or HIPAA's security requirements for protecting health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade tinyexr to a patched version where the remaining-length value is properly tracked in the loop. If upgrading is not possible, disable multipart EXR parsing or restrict parsing to trusted files only. Apply input validation to reject malformed EXR files.

Useful 0 Not Useful 0