Academysoftwarefoundation Openimageio vulnerabilities

CVE-2026-43908 [HIGH] CWE-190 CVE-2026-43908: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB() causes the function to compute a large negative pointer offset into the output buffer, pr

CVE-2026-43909 [HIGH] CWE-125 CVE-2026-43909: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with

CVE-2026-63638 [HIGH] CWE-787 CVE-2026-63638: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted cineon image can declare unsupported component bit depth 26. cineoninput::open() maps it to a 32-bit imagespec, but libcineon maps the unsupported depth to an 8-byte

CVE-2026-43907 [HIGH] CWE-190 CVE-2026-43907: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed integer overflow in QueryRGBBufferSizeInternal() in DPXColorConverter.cpp leads to a heap-based out-of-bounds write when processing crafted DPX image files. The function computes buf

CVE-2026-63419 [HIGH] CWE-787 CVE-2026-63419: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A zbuffer-only tiled iff is exposed with a 16-bit public imagespec while the decoder retains a 32-bit internal pixel size. iffinput::read_native_tile() copies according to m_h

CVE-2026-63422 [HIGH] CWE-122 CVE-2026-63422: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A valid tiled openexr image whose width is not a multiple of its tile width can trigger an overflow when a caller reads a partial edge-tile rectangle. openexrinput::read_nativ

CVE-2026-67549 [HIGH] CWE-122 CVE-2026-67549: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_conv

CVE-2026-43906 [HIGH] CWE-122 CVE-2026-43906: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential

CVE-2026-43905 [HIGH] CWE-190 CVE-2026-43905: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small va

CVE-2026-43904 [HIGH] CWE-787 CVE-2026-43904: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std:

CVE-2026-43903 [HIGH] CWE-787 CVE-2026-43903: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIO_DASSERT for bounds checking in the RLE decode loop. In release builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210), making all bounds checks no-op

CVE-2026-59156 [MEDIUM] CWE-674 CVE-2026-59156: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes fitsinput::read_fits_header() call itself without a depth bound.

CVE-2026-7582 [MEDIUM] CWE-119 CVE-2026-7582: A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulner A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be approached locally. The exploit is now public and may be used. The patch is

CVE-2026-59956 [MEDIUM] CWE-125 CVE-2026-59956: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg() allocate a temporary scanline from m_header.rgba_count but copy from it using m_header.pixel_bytes

CVE-2026-65970 [MEDIUM] CWE-825 CVE-2026-65970: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, a crafted ZIP-compressed TIFF processed with TIFF multithreading enabled can make TIFFInput::read_native_scanlines() return through an error path while asynchronous strip-decompression work remains queu

CVE-2026-59181 [MEDIUM] CWE-121 CVE-2026-59181: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while fil

CVE-2026-63420 [MEDIUM] CWE-125 CVE-2026-63420: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, An indexed psd with transparency metadata creates fewer stored channel_buffers than the spec.nchannels value advertised by the rawcolor path. when oiio:rawcolor or psd:rawda

CVE-2026-43996 [MEDIUM] CWE-125 CVE-2026-43996: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition wraps to 0, which compares less than p

CVE-2026-65969 [MEDIUM] CWE-125 CVE-2026-65969: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette() computes numpixels multiplied by the palette partition width in signed

CVE-2026-63635 [MEDIUM] CWE-125 CVE-2026-63635: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid color_mode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled. psdinput::setup() then uses the attacker-controlled value t