Skip to content

GHSA-cx6p-vjc6-3php on CTRL-OS 26.05

Aliases: GHSA-cx6p-vjc6-3php

Packages: openexr

Status: Plausible

Advisory Information

poc.zip

Summary

A malformed DWAA/DWAB EXR can declare a DWA UNKNOWN stream shorter than the byte count required by UNKNOWN-classified channels. OpenEXR accepts the short declared stream, then the UNKNOWN row-copy path reconstructs full channel rows from _planarUncBuffer[UNKNOWN], exposing bytes that were never initialized by the file's UNKNOWN stream.

This is a file-triggered uninitialized pixel disclosure, the focused harness aborts intentionally after detecting allocator-pattern bytes in decoded output.

Affected path

In src/lib/OpenEXRCore/internal_dwa_compressor.h:

  • UNKNOWN_UNCOMPRESSED_SIZE is read from the DWA chunk counters.
  • The decoder checks only that unknownUncompressedSize <= _planarUncBufferSize[UNKNOWN] before inflating UNKNOWN data.
  • The UNKNOWN channel copy loop later copies chan->width * pixelSize for each row until the full channel is reconstructed, bounded by _planarUncBufferSize[UNKNOWN], not by the initialized UNKNOWN byte count.

For the PoC:

channel X requirement       = 64 * 32 * 2 = 4096 bytes
UNKNOWN_UNCOMPRESSED_SIZE   = 20
UNKNOWN_COMPRESSED_SIZE     = 11
zlib UNKNOWN output length  = 20
leaked allocator pattern    = 4076/4096 decoded bytes

Reproduction

From /home/br0nzu/openexr/v3.4.13:

./report/45.\ OpenEXR\ v3.4.13\ DWA\ UNKNOWN\ declared\ short\ uninitialized\ pixel\ disclosure/reproduce.sh

Fresh validation results:

v3.4.13 exrcheck safe/PoC: rc=0 OK
v3.4.13 harness PoC original/ASAN/UBSAN: rc=134, leaked allocator pattern into channel 0: 4076/4096 bytes
origin-main snapshot harness PoC original/ASAN/UBSAN: rc=134, same 4076/4096 disclosure

The origin/main source checked at 6820342930d35c7c81a6b220c4a0aca9c2532542 still lacks a check that UNKNOWN_UNCOMPRESSED_SIZE is at least the byte count required by UNKNOWN-classified channels.

PoC package

poc.zip contains only the files needed for reproduction:

reproduce.sh
poc_dwaa_unknown_decl20_actual20_channel4096.exr
poc_materials/base_dwaa_unknown_x.exr
poc_materials/fuzz_dwa_unknown_declared_short_api.cpp

Impact

An attacker who can supply an EXR image to an application using OpenEXR can cause decoded UNKNOWN-channel pixel data to contain stale heap bytes from the decoding process. Applications that save, display, transmit, or otherwise expose decoded pixels may leak process memory contents.

Updates

2026-08-11 03:51 CEST

Metadata changes:

  • Status for package openexr: “Plausible”

2026-08-11 03:31 CEST

Metadata changes:

  • Status for package openexr: “New”