CVE-2023-22845 in OpenImageIO
Summary
by MITRE • 03/30/2023
An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially crafted targa file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/06/2025
The vulnerability CVE-2023-22845 represents a critical out-of-bounds read flaw within the OpenImageIO project's TGAInput::decode_pixel() function, specifically affecting version 2.4.7.1. This issue stems from insufficient input validation and boundary checking during the processing of Targa image files, creating a scenario where maliciously crafted files can exploit the software's parsing logic. The vulnerability manifests when the application attempts to read pixel data from a Targa file without proper verification of array bounds, allowing an attacker to manipulate the file structure to access memory locations beyond the intended data boundaries.
The technical implementation of this flaw occurs within the image decoding pipeline where the TGAInput::decode_pixel() method processes pixel information from Targa format files. When parsing malformed Targa files, the function fails to validate the dimensions and data structure specifications before attempting to access pixel memory locations. This allows an attacker to craft a Targa file with manipulated header values or data sequences that cause the decoder to read beyond allocated memory regions, potentially exposing sensitive data from adjacent memory segments. The vulnerability aligns with CWE-129, which addresses insufficient validation of length of input buffers, and CWE-131, which covers incorrect calculation of buffer size.
From an operational perspective, this vulnerability poses significant risks to systems that process untrusted image files, particularly in environments where OpenImageIO is used for image handling, such as content management systems, digital asset management platforms, or any application that accepts user-uploaded Targa images. The information disclosure aspect means that attackers could potentially extract sensitive data from memory, including cryptographic keys, user credentials, or application state information, depending on what resides in the affected memory regions. The exploit requires only the ability to upload or process a malicious Targa file, making it particularly dangerous in web applications or services that handle user-submitted content without proper sanitization.
The attack surface for this vulnerability extends across various deployment scenarios where OpenImageIO is integrated, including but not limited to web applications, image processing pipelines, and multimedia applications. The ATT&CK framework categorizes this as a privilege escalation technique through code injection, as the information disclosure could potentially lead to further exploitation opportunities. Organizations using OpenImageIO in production environments should consider implementing immediate mitigations including input validation, file format sanitization, and restricting file upload capabilities for Targa files until a patched version is deployed. Additionally, runtime protections such as address space layout randomization and stack canaries may provide partial defense-in-depth against potential exploitation attempts.