Skip to content

Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)

High
lgritz published GHSA-cq46-hp4h-cvfr May 3, 2026

Package

No package listed

Affected versions

<=3.2.0.1-dev

Patched versions

>= 3.0.18.0, >= 3.1.13.0, >= 3.2.0.2

Description

A signed 32-bit integer overflow in QueryRGBBufferSizeInternal() affects two separate case branches, producing heap out-of-bounds writes via different descriptors:

  • Case 1 (kCbYCr, line 298): pixels * -3 * bytes — wraps to +1 for large pixels

    • -> m_decodebuf.resize(1); fread writes 15 bytes → 14-byte OOB write

  • Case 2 (kABGR, line 306): pixels * -4 * bytes — wraps to +2,147,483,644

    • -> m_decodebuf.resize(2,147,483,644); fread writes 2,147,483,652 bytes -> 8-byte OOB write

Both cases share the same root cause (signed overflow in the same function). Two PoC files are attached, one for each affected descriptor.

  • Version: 3.2.0.1-dev
  • Commit: c75e31f

Root cause (DPXColorConverter.cpp):

static inline int QueryRGBBufferSizeInternal(
    const Descriptor desc, const int pixels, const int bytes) {
    ...
    case kCbYCr:              // line 298 — 4:4:4 YCbCr
        return pixels * -3 * bytes;
    ...
    case kCbYCrA:
    case kRGBA:
    case kABGR:               // line 306 — ABGR / 4:4:4:4 YCbCrA
        return pixels * -4 * bytes;
}

All arithmetic is 32-bit signed int. A negative return value is the intended signal that no separate buffer is needed (in-place conversion). For large pixel counts the true result is more negative than INT_MIN, wrapping to a small positive number.
dpxinput.cpp:603 checks if (bufsize > 0) and allocates m_decodebuf with that incorrect size. ReadDirect then writes the full imageByteSize into the undersized buffer leading to heap out-of-bounds write.

Case 1: kCbYCr (line 298)

PoC file: poc_dpx_cbycr_oob.dpx

Run:

  ./bin/oiiotool --hash poc_dpx_cbycr_oob.dpx

Or

  ./bin/iinfo   --hash poc_dpx_cbycr_oob.dpx

Case 1: kABGR (line 306)

PoC file: poc_dpx_abgr_oob.dpx (~2.1 GB sparse)

Run:

  ./bin/oiiotool --hash poc_dpx_abgr_oob.dpx

Or

  ./bin/iinfo   --hash poc_dpx_abgr_oob.dpx
Sanitizer Output — Case 1 (kCbYCr) 
 $ ./bin/oiiotool --hash ../poc_dpx_cbycr_oob.dpx
/home/roo/Desktop/OpenImageIO/OpenImageIO/src/dpx.imageio/libdpx/DPXColorConverter.cpp:298:26: runtime error: signed integer overflow: 1431655765 * -3 cannot be represented in type 'int'
=================================================================
==47723==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xdc3fbaa0f851 at pc 0xe01fcdf2f4cc bp 0xfffffb1e5b50 sp 0xfffffb1e5330
WRITE of size 15 at 0xdc3fbaa0f851 thread T0
    #0 0xe01fcdf2f4c8 in fread ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1030
    #1 0xe01fbd6b3f90 in OpenImageIO::v3_1::Filesystem::IOFile::read(void*, unsigned long) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xc73f90) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625)
    #2 0xe01fc5ff4c90 in dpx::Reader::ReadBlock(int, unsigned char*, dpx::Block&) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x77e4c90) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #3 0xe01fc5f4dc20 in OpenImageIO::v3_2_0::DPXInput::read_native_scanlines(int, int, int, int, int, void*) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x773dc20) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #4 0xe01fc5729b14 in OpenImageIO::v3_1::ImageInput::read_native_scanlines(int, int, int, int, OpenImageIO::v3_1::span<std::byte, 18446744073709551615ul>) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f19b14) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #5 0xe01fc5743304 in OpenImageIO::v3_1::ImageInput::read_scanlines(int, int, int, int, int, int, int, OpenImageIO::v3_1::TypeDesc, void*, long, long) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f33304) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #6 0xe01fc573908c in OpenImageIO::v3_1::ImageInput::read_image(int, int, int, int, OpenImageIO::v3_1::TypeDesc, void*, long, long, long, bool (*)(void*, float), void*) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f2908c) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #7 0xe01fc5aab598 in OpenImageIO::v3_2_0::pvt::compute_sha1(OpenImageIO::v3_1::ImageInput*, int, int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x729b598) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #8 0xb0b6e66aff78 in print_info_subimage(std::ostream&, OpenImageIO::v3_2_0::OiioTool::Oiiotool&, int, int, int, OpenImageIO::v3_1::ImageSpec const&, OpenImageIO::v3_2_0::OiioTool::ImageRec*, OpenImageIO::v3_1::ImageInput*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO::v3_2_0::pvt::print_info_options const&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> >&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> >&, OpenImageIO::v3_1::ImageSpec::SerialFormat, OpenImageIO::v3_1::ImageSpec::SerialVerbose) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0x121ff78) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #9 0xb0b6e66bd480 in OpenImageIO::v3_2_0::OiioTool::print_info(std::ostream&, OpenImageIO::v3_2_0::OiioTool::Oiiotool&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO::v3_2_0::pvt::print_info_options const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0x122d480) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #10 0xb0b6e640907c in input_file(OpenImageIO::v3_2_0::OiioTool::Oiiotool&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>) [clone .isra.0] (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xf7907c) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #11 0xb0b6e6465210 in std::_Function_handler<void (OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>), OpenImageIO::v3_1::ArgParse::Arg::action(std::function<void (OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>)#1}>::_M_invoke(std::_Any_data const&, OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>&&) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xfd5210) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #12 0xe01fbd599cac in OpenImageIO::v3_1::ArgParse::Impl::parse_args(int, char const**) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xb59cac) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625)
    #13 0xe01fbd5a5260 in OpenImageIO::v3_1::ArgParse::parse_args(int, char const**) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xb65260) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625)
    #14 0xb0b6e642a618 in OpenImageIO::v3_2_0::OiioTool::Oiiotool::getargs(int, char**) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xf9a618) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #15 0xb0b6e611b250 in main (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xc8b250) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #16 0xe01fbbe42598 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #17 0xe01fbbe42678 in __libc_start_main_impl ../csu/libc-start.c:360
    #18 0xb0b6e61206ec in _start (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xc906ec) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)

0xdc3fbaa0f851 is located 0 bytes after 1-byte region [0xdc3fbaa0f850,0xdc3fbaa0f851)
allocated by thread T0 here:
    #0 0xe01fcdfab17c in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:86
    #1 0xe01fc58af6b4 in std::vector<unsigned char, std::allocator<unsigned char> >::_M_default_append(unsigned long) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x709f6b4) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #2 0xe01fc5f4db78 in OpenImageIO::v3_2_0::DPXInput::read_native_scanlines(int, int, int, int, int, void*) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x773db78) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #3 0xe01fc5729b14 in OpenImageIO::v3_1::ImageInput::read_native_scanlines(int, int, int, int, OpenImageIO::v3_1::span<std::byte, 18446744073709551615ul>) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f19b14) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #4 0xe01fc5743304 in OpenImageIO::v3_1::ImageInput::read_scanlines(int, int, int, int, int, int, int, OpenImageIO::v3_1::TypeDesc, void*, long, long) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f33304) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #5 0xe01fc573908c in OpenImageIO::v3_1::ImageInput::read_image(int, int, int, int, OpenImageIO::v3_1::TypeDesc, void*, long, long, long, bool (*)(void*, float), void*) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x6f2908c) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #6 0xe01fc5aab598 in OpenImageIO::v3_2_0::pvt::compute_sha1(OpenImageIO::v3_1::ImageInput*, int, int, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO.so.3.2.0+0x729b598) (BuildId: d9a5db60d654cc4cee69dab2ea5033ad225a5a0f)
    #7 0xb0b6e66aff78 in print_info_subimage(std::ostream&, OpenImageIO::v3_2_0::OiioTool::Oiiotool&, int, int, int, OpenImageIO::v3_1::ImageSpec const&, OpenImageIO::v3_2_0::OiioTool::ImageRec*, OpenImageIO::v3_1::ImageInput*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO::v3_2_0::pvt::print_info_options const&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> >&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> >&, OpenImageIO::v3_1::ImageSpec::SerialFormat, OpenImageIO::v3_1::ImageSpec::SerialVerbose) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0x121ff78) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #8 0xb0b6e66bd480 in OpenImageIO::v3_2_0::OiioTool::print_info(std::ostream&, OpenImageIO::v3_2_0::OiioTool::Oiiotool&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO::v3_2_0::pvt::print_info_options const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0x122d480) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #9 0xb0b6e640907c in input_file(OpenImageIO::v3_2_0::OiioTool::Oiiotool&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>) [clone .isra.0] (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xf7907c) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #10 0xb0b6e6465210 in std::_Function_handler<void (OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>), OpenImageIO::v3_1::ArgParse::Arg::action(std::function<void (OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>)>&&)::{lambda(OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>)#1}>::_M_invoke(std::_Any_data const&, OpenImageIO::v3_1::ArgParse::Arg&, OpenImageIO::v3_1::span<char const* const, 18446744073709551615ul>&&) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xfd5210) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #11 0xe01fbd599cac in OpenImageIO::v3_1::ArgParse::Impl::parse_args(int, char const**) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xb59cac) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625)
    #12 0xe01fbd5a5260 in OpenImageIO::v3_1::ArgParse::parse_args(int, char const**) (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xb65260) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625)
    #13 0xb0b6e642a618 in OpenImageIO::v3_2_0::OiioTool::Oiiotool::getargs(int, char**) (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xf9a618) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #14 0xb0b6e611b250 in main (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xc8b250) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)
    #15 0xe01fbbe42598 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #16 0xe01fbbe42678 in __libc_start_main_impl ../csu/libc-start.c:360
    #17 0xb0b6e61206ec in _start (/home/roo/Desktop/OpenImageIO/build/bin/oiiotool+0xc906ec) (BuildId: 26dc66bb500e400fe6af08ca81c9b6cb3d954d90)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/roo/Desktop/OpenImageIO/build/lib/libOpenImageIO_Util.so.3.2.0+0xc73f90) (BuildId: 3650f1d2b564882e0c070606c1b37db90bc86625) in OpenImageIO::v3_1::Filesystem::IOFile::read(void*, unsigned long)
Shadow bytes around the buggy address:
  0xdc3fbaa0f580: fa fa fd fa fa fa 00 fa fa fa 00 fa fa fa fd fa
  0xdc3fbaa0f600: fa fa 00 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0xdc3fbaa0f680: fa fa fd fa fa fa 00 fa fa fa 00 00 fa fa 00 00
  0xdc3fbaa0f700: fa fa 00 00 fa fa fd fa fa fa 00 00 fa fa 00 00
  0xdc3fbaa0f780: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0xdc3fbaa0f800: fa fa 04 fa fa fa fd fd fa fa[01]fa fa fa fa fa
  0xdc3fbaa0f880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xdc3fbaa0f900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xdc3fbaa0f980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xdc3fbaa0fa00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0xdc3fbaa0fa80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==47723==ABORTING
Sanitizer Output — Case 2 (kABGR) 
 $ ./bin/oiiotool --hash ../poc_dpx_abgr_oob.dpx
/home/roo/Desktop/OpenImageIO/OpenImageIO/src/dpx.imageio/libdpx/DPXColorConverter.cpp:306:26: runtime error: signed integer overflow: 536870913 * -4 cannot be represented in type 'int'
==100095==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf7c4aac0c7fc
WRITE of size 2147483652 at 0xf7c4aac0c7fc thread T0
    #0  fread
    #1  OpenImageIO::v3_1::Filesystem::IOFile::read(void*, unsigned long)
    #2  dpx::Reader::ReadBlock(int, unsigned char*, dpx::Block&)
    #3  OpenImageIO::v3_2_0::DPXInput::read_native_scanlines(...)
    #4  OpenImageIO::v3_1::ImageInput::read_native_scanlines(...)
    #5  OpenImageIO::v3_1::ImageInput::read_scanlines(...)
    #6  OpenImageIO::v3_1::ImageInput::read_image(...)
    #7  OpenImageIO::v3_2_0::pvt::compute_sha1(...)
    #8  print_info_subimage(...)  [oiiotool]
    ...
    #14 main  [oiiotool]

0xf7c4aac0c7fc is located 0 bytes after 2147483644-byte region
  allocated by DPXInput::read_native_scanlines → m_decodebuf.resize(bufsize)

SUMMARY: AddressSanitizer: heap-buffer-overflow in IOFile::read(void*, unsigned long)

Impact:

  • Immediate: DoS — process crashes unconditionally on opening a crafted DPX file
    via any code path that reads pixel data (oiiotool, iinfo, any library
    consumer calling read_image or read_scanlines)
  • Potential: Heap corruption — fread writes attacker-controlled pixel bytes into adjacent heap memory

Suggested fix (DPXColorConverter.cpp:290-329):

The function uses a negative return value as an in-band signal for "no separate
buffer needed". This design makes overflow silent. Change the return type to
ptrdiff_t and use pointer-width arithmetic — one fix closes both line 298 and 306:

// before
static inline int QueryRGBBufferSizeInternal(..., const int pixels, const int bytes)
    case kCbYCr:
        return pixels * -3 * bytes;   // line 298
    case kABGR:
        return pixels * -4 * bytes;   // line 306
// after
static inline ptrdiff_t QueryRGBBufferSizeInternal(..., size_t pixels, int bytes)
    case kCbYCr:
        return -(ptrdiff_t)(pixels * 3 * (size_t)bytes);  // negative = in-place
    case kABGR:
        return -(ptrdiff_t)(pixels * 4 * (size_t)bytes);  // negative = in-place

Then in dpxinput.cpp, change bufsize to ptrdiff_t and check bufsize < 0 for the in-place path. For descriptors that require a separate buffer (kCbYCrY,kCbYACrYA), compute the size using overflow-safe arithmetic:

imagesize_t alloc = clamped_mult64(
    clamped_mult64((imagesize_t)pixels, (imagesize_t)3),
    (imagesize_t)bytes);
if (alloc == std::numeric_limits<imagesize_t>::max()) {
    errorfmt("DPX image dimensions too large");
    return false;
}
m_decodebuf.resize(alloc);

Maybe also add a check_open() call to the DPX plugin (currently absent) to enforce the framework's limit_imagesize_MB safeguard before any allocation.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

CVE ID

CVE-2026-43907

Weaknesses

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. Learn more on MITRE.

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer. Learn more on MITRE.

Credits