Vulnerability Spotlight: Specially crafted files could lead to denial of service, information disclosure in Open ImageIO parser

Summary: Cisco Talos discovered three vulnerabilities in the OpenImageIO image-parsing library used by 3-D rendering software including Blender and AliceVision. Two of them, TALOS-2023-1707 (CVE-2023-24473) and TALOS-2023-1708 (CVE-2023-22845), could disclose sensitive information when an adversary sends a specially crafted Targa (.tga) file, while TALOS-2023-1709 (CVE-2023-24472) is a denial-of-service issue continuing from TALOS-2022-1653.
Bottom line: Talos confirmed version 2.4.7.1 could still be exploited, and CVE-2022-43595, first found in December, was not fixed in the most recent OpenImageIO release - so anyone running the library inside a rendering pipeline should verify what version is actually deployed.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-43594 CVE-2022-43595 CVE-2023-22845 CVE-2023-24472 CVE-2023-24473
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026