CVE-2026-43909
published 2026-05-14CVE-2026-43909: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and…
PriorityP347high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.37%
29.4th percentile
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| academysoftwarefoundation | openimageio | < 3.0.18.0 | 3.0.18.0 |
| academysoftwarefoundation | openimageio | — | — |
| openimageio | openimageio | < 3.0.18.0 | 3.0.18.0 |
| openimageio | openimageio | — | — |
| openimageio | openimageio | — | — |
| openimageio | openimageio | >= 3.1.4.0 < 3.1.13.0 | 3.1.13.0 |
| ubuntu | openimageio | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
bugzilla·2026-05-15·CVSS 8.8
CVE-2026-43909 [HIGH] CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [epel-all]
bugzilla·2026-05-15·CVSS 8.8
CVE-2026-43909 [HIGH] CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [epel-all]
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43909 OpenImageIO2.5: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
bugzilla·2026-05-15·CVSS 8.8
CVE-2026-43909 [HIGH] CVE-2026-43909 OpenImageIO2.5: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
CVE-2026-43909 OpenImageIO2.5: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing
bugzilla·2026-05-14·CVSS 8.8
CVE-2026-43909 [HIGH] CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing
CVE-2026-43909 OpenImageIO: OpenImageIO: Arbitrary code execution or denial of service via integer overflow in image processing
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
2026-05-14
Published