CVE-2017-9111

What it actually does

Invalid 8-byte write in the storeSSE function within ImfOptimizedPixelReading.h allows memory corruption that can crash the process or permit arbitrary code execution when processing a specially crafted OpenEXR image.

Why it matters to the business

Organizations that ingest or render OpenEXR files risk application crashes, denial of service, or full compromise of systems handling untrusted imagery, potentially disrupting media pipelines and increasing incident-response costs.

How an attack unfolds

An attacker crafts a malicious OpenEXR file that triggers the invalid write; when a victim application loads the file, the overflow corrupts memory and can be leveraged to execute attacker-controlled code or simply crash the process.

How to fix it

Upgrade academysoftwarefoundation/openexr to commit dcaf5fdb4d1244d8e60a58832cfe9c54734a2257 or later; for Chainguard and Wolfi packages update terraform, terraform-compat, and terraform-local-provider-config to version 1.5.7-r4 or newer.

How to confirm the fix worked

Confirm the installed OpenEXR library reports a version containing the referenced commit or package revision 1.5.7-r4; re-run any existing fuzzing or regression tests that exercise ImfOptimizedPixelReading.h.

Typical attack path

1. Craft malicious OpenEXR file exploiting the storeSSE write flaw
2. Deliver the file via web download, email attachment, or shared storage
3. Victim application opens or renders the file
4. Memory corruption occurs leading to crash or code execution

How to detect it

Monitor application logs and crash dumps for segmentation faults or access violations originating from ImfOptimizedPixelReading or storeSSE when processing OpenEXR content; correlate with file-origin metadata for suspicious sources.

What your security team should do

• Immediately inventory all systems that depend on OpenEXR and schedule upgrades to the listed fixed versions
• Block or sandbox untrusted OpenEXR files until patches are applied
• Add OpenEXR version checks to software bill-of-materials and CI pipelines