CVE-2022-38529

What it actually does

Heap buffer overflow in rleUncompress during RLE decompression of EXR image data, enabling out-of-bounds memory writes.

Why it matters to the business

Applications handling untrusted EXR files risk crashes or arbitrary code execution, potentially disrupting image-processing pipelines or enabling system compromise.

How an attack unfolds

An attacker supplies a malformed EXR file containing crafted RLE data that triggers the overflow in rleUncompress when the library parses the file.

How to fix it

Upgrade tinyexr to a commit after 0647fb3 that resolves the bounds issue in rleUncompress; where updates are unavailable, sandbox image processing or reject untrusted EXR inputs.

How to confirm the fix worked

Rebuild with address sanitizer and replay known triggering EXR samples, or inspect source for proper buffer sizing before rleUncompress calls.

Typical attack path

1. Craft malicious EXR file with oversized RLE payload
2. Deliver file via email, web download, or shared storage
3. Victim application opens the file using the vulnerable tinyexr library
4. Overflow occurs during decompression leading to code execution or denial of service

How to detect it

Search application and system logs for segmentation faults or heap errors immediately after EXR file access; correlate with file-creation timestamps from untrusted sources.

What your security team should do

• Inventory all products shipping tinyexr and schedule upgrades
• Apply strict file-type and size controls on EXR ingestion points
• Add runtime memory-error monitoring around image decoders