Log in Start free

Vulnerability · Published Jun 22, 2022 · Assigned by mitre

CVE-2022-34300

High 8.8

In plain English

A high-severity security flaw in the tinyexr package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12tinyexr1.0.1+dfsg-4DEBIAN-CVE-2022-34300
Debian:13tinyexr1.0.1+dfsg-4DEBIAN-CVE-2022-34300
Debian:14tinyexr1.0.1+dfsg-4DEBIAN-CVE-2022-34300
Ubuntu:22.04:LTSasymptoteno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSasymptoteno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10asymptoteno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSasymptoteno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10asymptoteno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10godotno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSgoxelno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSgoxelno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10goxelno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSgoxelno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10goxelno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSloveno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSloveno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10loveno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSloveno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10loveno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10mame0.277+dfsg.1-4ubuntu0.1UBUNTU-CVE-2022-34300
Ubuntu:25.10mame0.277+dfsg.1-4ubuntu0.1USN-7913-1
Ubuntu:26.04:LTSmameno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10mameno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSpsychtoolbox-3no fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSpsychtoolbox-3no fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10psychtoolbox-3no fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSpsychtoolbox-3no fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10psychtoolbox-3no fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSqt6-webengineno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSqt6-webengineno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10qt6-webengineno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSqt6-webengineno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10qt6-webengineno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSrbdoom3bfgno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTSrbdoom3bfgno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10rbdoom3bfgno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTSrbdoom3bfgno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10rbdoom3bfgno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTSrenderdocno fix listedUBUNTU-CVE-2022-34300
Ubuntu:22.04:LTStinyexrno fix listedUBUNTU-CVE-2022-34300
Ubuntu:24.04:LTStinyexrno fix listedUBUNTU-CVE-2022-34300
Ubuntu:25.10tinyexrno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.04:LTStinyexrno fix listedUBUNTU-CVE-2022-34300
Ubuntu:26.10tinyexrno fix listedUBUNTU-CVE-2022-34300

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References