CVE-2026-43909
HighSummary
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the SwapRGBABytes() function causes a large negative pointer offset when processing large kABGR DPX images. This results in immediate crashes and out-of-bounds reads and writes.
Risk Assessment
Organizations may face application crashes and potential data leaks from memory, leading to serious security and stability issues.
Recommendation
It is recommended to update OpenImageIO to versions 3.0.18.0 or 3.1.13.0 to mitigate this vulnerability.
Other vulnerabilities in OpenImageIO
See all- CVE-2026-43908High
In OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression causes an out-of-bounds write that crashes the process.
- CVE-2026-43907High
In OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow occurs due to a signed integer overflow in the QueryRGBBufferSizeInternal() function. This issue arises when processing crafted DPX image files, leading to writes outside the allocated buffer.
- CVE-2026-43906High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a heap-based buffer overflow in the HEIF decoder, allowing out-of-bounds writes. This can lead to memory corruption and potential code execution.
- CVE-2026-43905High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 has a vulnerability related to buffer size calculation in jpeg2000input.cpp, leading to heap overflow. This issue occurs when the product of image dimensions exceeds the maximum value for 32-bit arithmetic, resulting in the allocation of an undersized buffer.
- CVE-2026-43904High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability that allows for heap overflow up to 65535 bytes due to improper clamping of run length in .pic files. The issue occurs in the code responsible for processing RLE.
- CVE-2026-43903High
OpenImageIO prior to versions 3.0.18.0 and 3.1.13.0 contains a vulnerability in sgiinput.cpp where the use of OIIO_DASSERT for bounds checking in the RLE decode loop does not function in release builds. As a result, a crafted .sgi file with RLE count exceeding scanline width causes heap buffer overflow and crash.
- CVE-2023-36183High
Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.
Original NVD description (English source)
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.