CVE-2024-31047

What it actually does

Local attacker supplies crafted input to the convert function in exrmultipart.cpp, triggering a crash or resource exhaustion that results in denial of service.

Why it matters to the business

Disrupts image-processing workflows that rely on the affected library, causing application crashes and potential downtime for rendering or media pipelines with no ransomware or remote exploitation observed.

How an attack unfolds

An attacker with local access invokes the vulnerable convert routine with malicious multipart EXR data; the flaw leads to an unhandled condition that terminates the process or exhausts local resources.

How to fix it

Upgrade openexr to the commit a1a00ffeecf627bbbc010d40700720bee48b2af7 or later; for linux-lts (Alpaquita) update to version 6.12.41-r0 or newer.

How to confirm the fix worked

Confirm the installed openexr package or binary reports a version containing commit a1a00ffeecf627bbbc010d40700720bee48b2af7; re-run unit tests or fuzzing against the convert path with previously crashing inputs.

Typical attack path

1. Obtain local access to a system running the vulnerable openexr library
2. Prepare or obtain a specially crafted EXR multipart file
3. Invoke exrmultipart or another binary that calls the convert function with the crafted input
4. Trigger the denial-of-service condition

How to detect it

Review local process crash logs and application error reports for unexpected terminations when handling EXR multipart files; correlate with user activity on systems that process such images.

What your security team should do

• Apply the listed fixed versions to all affected openexr installations within normal change windows
• Scan build and dependency manifests for openexr versions prior to the fixed commit
• Add openexr to the list of libraries rebuilt during routine image-processing toolchain updates