VYPR
← All advisories
High severity7.8OSV Advisory· Published May 14, 2026· Updated Jun 17, 2026

CVE-2026-43904

CVE-2026-43904

Description

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • AcademySoftwareFoundation/OpenimageioOSV2 versions
    v3.1.12.0, v3.0.17.0, v3.1.11.0, …+ 1 more
    • (no CPE)range: v3.1.12.0, v3.0.17.0, v3.1.11.0, …
    • (no CPE)range: <3.0.18.0, <3.1.13.0
  • OpenImageIO/Openimageio2 versions
    cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*range: <3.0.18.0
    • (no CPE)range: <3.0.18.0, <3.1.13.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.