CVE-2026-43907
HighSummary
In OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow occurs due to a signed integer overflow in the QueryRGBBufferSizeInternal() function. This issue arises when processing crafted DPX image files, leading to writes outside the allocated buffer.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code or gain access to memory, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to update OpenImageIO to version 3.0.18.0 or 3.1.13.0 or later to mitigate this vulnerability. Additionally, it is advisable to monitor and validate processed DPX files for potential threats.
Other vulnerabilities in OpenImageIO
See all- CVE-2026-43909High
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the SwapRGBABytes() function causes a large negative pointer offset when processing large kABGR DPX images. This results in immediate crashes and out-of-bounds reads and writes.
- CVE-2026-43908High
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression causes an out-of-bounds write that crashes the process.
- CVE-2026-43906High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a heap-based buffer overflow in the HEIF decoder, allowing out-of-bounds writes. This can lead to memory corruption and potential code execution.
- CVE-2026-43905High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 has a vulnerability related to buffer size calculation in jpeg2000input.cpp, leading to heap overflow. This issue occurs when the product of image dimensions exceeds the maximum value for 32-bit arithmetic, resulting in the allocation of an undersized buffer.
- CVE-2026-43904High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability that allows for heap overflow up to 65535 bytes due to improper clamping of run length in .pic files. The issue occurs in the code responsible for processing RLE.
- CVE-2026-43903High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability in sgiinput.cpp where the use of OIIO_DASSERT for bounds checking in the RLE decode loop does not function in release builds. As a result, a crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash.
- CVE-2023-36183High
Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.
Original NVD description (English source)
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed integer overflow in QueryRGBBufferSizeInternal() in DPXColorConverter.cpp leads to a heap-based out-of-bounds write when processing crafted DPX image files. The function computes buffer sizes using 32-bit signed integer arithmetic with negative multipliers (e.g., pixels * -3 * bytes for kCbYCr descriptors and pixels * -4 * bytes for kABGR descriptors), where a negative result is used as an in-band signal that no separate buffer is needed. When the pixel count is sufficiently large, the multiplication overflows INT_MIN and wraps to a small positive value. The caller in dpxinput.cpp interprets this positive value as a required buffer size, allocates an undersized heap buffer via m_decodebuf.resize(), and then writes the full image data into it via fread, resulting in a heap buffer overflow. An attacker can exploit this