-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| afichet/openexr-viewer | actions | < 0.6.1 | 0.6.1 |
Miggo AIRoot Cause AnalysisThe crash occurs during pixel buffer writes (mov dword ptr [rax+rcx4+0Ch]) which matches the pattern of buffer overflow. The patch added overflow checks for widthheight multiplications and replaced raw allocations with std::vector. The vulnerable versions used unchecked 'new float[m_width*m_height]' allocations in both RGB and Y framebuffer load functions, making them susceptible to integer overflow-triggered buffer underallocations. The Windbg logs showing writes to invalid addresses align with this pattern of memory corruption.
GitHub ActionsGitHub ActionsOngoing coverage of React2Shell