Academysoftwarefoundation Openimageio vulnerabilities

CVE-2026-43908 [HIGH] CWE-190 CVE-2026-43908: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, pr

CVE-2026-43909 [HIGH] CWE-125 CVE-2026-43909: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with

CVE-2026-43907 [HIGH] CWE-190 CVE-2026-43907: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed integer overflow in QueryRGBBufferSizeInternal() in DPXColorConverter.cpp leads to a heap-based out-of-bounds write when processing crafted DPX image files. The function computes buf

CVE-2026-43906 [HIGH] CWE-122 CVE-2026-43906: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential

CVE-2026-43905 [HIGH] CWE-190 CVE-2026-43905: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small va

CVE-2026-43904 [HIGH] CWE-787 CVE-2026-43904: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std:

CVE-2026-43903 [HIGH] CWE-787 CVE-2026-43903: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-op

CVE-2026-7582 [MEDIUM] CWE-119 CVE-2026-7582: A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulner A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be approached locally. The exploit is now public and may be used. The patch is

CVE-2026-43996 [MEDIUM] CWE-125 CVE-2026-43996: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than p

CVE-2024-40630 [MEDIUM] CWE-125 CVE-2024-40630: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput: