CVE-2026-113681
published 2026-10-20CVE-2026-113681: OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.17%
5.4th percentile
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| academysoftwarefoundation | openimageio | < 3.0.20.0 | 3.0.20.0 |
| academysoftwarefoundation | openimageio | >= 3.1.0.0 < 3.1.15.0 | 3.1.15.0 |
| academysoftwarefoundation | openimageio | >= 3.2.0.0-dev < 3.2.0.3-beta1 | 3.2.0.3-beta1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [epel-all]
bugzilla·2026-10-21·CVSS 5.5
CVE-2026-113681 [MEDIUM] CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [epel-all]
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Bugzilla
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-43]
bugzilla·2026-10-21·CVSS 5.5
CVE-2026-113681 [MEDIUM] CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-43]
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Bugzilla
CVE-2026-113681 OpenImageIO2.5: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-all]
bugzilla·2026-10-21·CVSS 5.5
CVE-2026-113681 [MEDIUM] CVE-2026-113681 OpenImageIO2.5: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-all]
CVE-2026-113681 OpenImageIO2.5: OpenImageIO: Denial of Service via crafted Cineon image file [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Bugzilla
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file
bugzilla·2026-10-20·CVSS 5.5
CVE-2026-113681 [MEDIUM] CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file
CVE-2026-113681 OpenImageIO: OpenImageIO: Denial of Service via crafted Cineon image file
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
https://github.com/AcademySoftwareFoundation/OpenImageIO/blob/v3.0.19.0/src/cineon.imageio/libcineon/Codec.cpp#L79-L82https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5567https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5568https://www.vulncheck.com/advisories/openimageio-before-3.0.20.0-3.1-x-before-3.1.15.0-and-3.2-x-before-3.2.0.3-beta1-cineon-reader-heap-out-of-bounds-read
2026-10-20
Published