Academysoftwarefoundation Openimageio vulnerabilities

CVE-2026-113681 [MEDIUM] CWE-190 CVE-2026-113681: OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integ OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-

CVE-2026-50291 [MEDIUM] CWE-125 CVE-2026-50291: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. Bmp

CVE-2024-40630 [MEDIUM] CWE-125 CVE-2024-40630: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput: