High severity7.8OSV Advisory· Published May 14, 2026· Updated Jun 17, 2026
CVE-2026-43906
CVE-2026-43906
Description
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5v3.1.12.0, v3.0.17.0, v3.1.11.0, …+ 1 more
- (no CPE)range: v3.1.12.0, v3.0.17.0, v3.1.11.0, …
- (no CPE)range: >=3.0.18.0, >=3.1.13.0
cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*range: <3.0.18.0
- cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*
- (no CPE)range: >=3.0.18.0, >=3.1.13.0
Patches
Vulnerability mechanics
References
1- github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66nvdExploitVendor Advisory
News mentions
0No linked articles in our index yet.