tinyexr project tinyexr vulnerabilities

Latest tinyexr project tinyexr CVEs

Newest publication first

1. CVE-2022-38529 tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.

   Published 2022-09-06

   High·CVSS 7.8 EPSS 0.33%

   tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.

2. CVE-2022-34300 In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

   Published 2022-06-22

   High·CVSS 8.8 EPSS 1.5%

   In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

3. CVE-2020-18430 tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service (DOS).

   Published 2021-07-26

   High·CVSS 7.5 EPSS 1.2%

   tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which can lead to a denial of service (DOS).

4. CVE-2020-18428 tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service (DOS).

   Published 2021-07-26

   High·CVSS 7.5 EPSS 1.2%

   tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which can lead to a denial of service (DOS).

5. CVE-2020-19490 tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

   Published 2021-07-21

   Medium·CVSS 5.5 EPSS 0.83%

   tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

6. CVE-2018-20652 An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-s...

   Published 2019-01-01

   Medium·CVSS 6.5 EPSS 1.5%

   An attempted excessive memory allocation was discovered in the function tinyexr::AllocateImage in tinyexr.h in tinyexr v0.9.5. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted input, which leads to an out-of-memory exception.

7. CVE-2018-12688 tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.

   Published 2018-06-22

   Critical·CVSS 9.8 EPSS 1.6%

   tinyexr 0.9.5 has a segmentation fault in the wav2Decode function.

8. CVE-2018-12687 tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.

   Published 2018-06-22

   High·CVSS 7.5 EPSS 1.4%

   tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.

9. CVE-2018-12504 tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h.

   Published 2018-06-16

   High·CVSS 7.5 EPSS 1.6%

   tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h.

10. CVE-2018-12503 tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h.

    Published 2018-06-16

    Critical·CVSS 9.8 EPSS 1.8%

    tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h.

11. CVE-2018-12093 tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.

    Published 2018-06-11

    High·CVSS 7.5 EPSS 1.4%

    tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.

12. CVE-2018-12092 tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

    Published 2018-06-11

    Critical·CVSS 9.8 EPSS 1.6%

    tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

13. CVE-2018-12064 tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.

    Published 2018-06-08

    Critical·CVSS 9.8 EPSS 1.3%

    tinyexr 0.9.5 has a heap-based buffer over-read via tinyexr::ReadChannelInfo in tinyexr.h.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.