CVE-2022-43595

Name: CVE-2022-43595
Creator: NVD / NIST
Published: 2022-12-22T22:15:16.287+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.9/10EPSS 1.24%

Last modified Jun 17, 2026

CVE-2022-43595 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. EPSS estimates a 1.24% chance of exploitation in the next 30 days.

Description

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these vulnerabilities.This vulnerability applies to writing .fits files.

Metrics

CVSS 3.1

5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

1.24%

65.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-476

Affected Software

Vendor	Product	Versions
Openimageio	Openimageio	2.4.4.2
Debian	Debian Linux	11.0

References

https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653Exploit, Third Party Advisory
https://www.debian.org/security/2023/dsa-5384Third Party Advisory
https://security.gentoo.org/glsa/202305-33
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1653Exploit, Third Party Advisory
https://www.debian.org/security/2023/dsa-5384Third Party Advisory

Timeline

Published: Dec 22, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-43595?

How severe is CVE-2022-43595?

CVE-2022-43595 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 1.24% probability of exploitation in the next 30 days.

How do I fix CVE-2022-43595?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-43595?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST