CVE-2026-43905
HighSummary
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 has a vulnerability related to buffer size calculation in jpeg2000input.cpp, leading to heap overflow. This issue occurs when the product of image dimensions exceeds the maximum value for 32-bit arithmetic, resulting in the allocation of an undersized buffer.
Risk Assessment
Heap overflow can lead to unauthorized memory access, posing a risk of malicious code execution and potential system takeover. Organizations should be aware of the threats associated with using vulnerable versions of the software.
Recommendation
It is recommended to update OpenImageIO to versions 3.0.18.0 or 3.1.13.0 to mitigate this vulnerability. Additionally, it is advisable to monitor and test applications using this tool for potential issues.
Other vulnerabilities in OpenImageIO
See all- CVE-2026-43909High
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the SwapRGBABytes() function causes a large negative pointer offset when processing large kABGR DPX images. This results in immediate crashes and out-of-bounds reads and writes.
- CVE-2026-43908High
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression causes an out-of-bounds write that crashes the process.
- CVE-2026-43907High
In OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow occurs due to a signed integer overflow in the QueryRGBBufferSizeInternal() function. This issue arises when processing crafted DPX image files, leading to writes outside the allocated buffer.
- CVE-2026-43906High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a heap-based buffer overflow in the HEIF decoder, allowing out-of-bounds writes. This can lead to memory corruption and potential code execution.
- CVE-2026-43904High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability that allows for heap overflow up to 65535 bytes due to improper clamping of run length in .pic files. The issue occurs in the code responsible for processing RLE.
- CVE-2026-43903High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability in sgiinput.cpp where the use of OIIO_DASSERT for bounds checking in the RLE decode loop does not function in release builds. As a result, a crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash.
- CVE-2023-36183High
Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.
Original NVD description (English source)
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.