VYPR
← All advisories
High severity7.8OSV Advisory· Published May 14, 2026· Updated Jun 17, 2026

CVE-2026-43906

CVE-2026-43906

Description

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • AcademySoftwareFoundation/OpenimageioOSV2 versions
    v3.1.12.0, v3.0.17.0, v3.1.11.0, …+ 1 more
    • (no CPE)range: v3.1.12.0, v3.0.17.0, v3.1.11.0, …
    • (no CPE)range: >=3.0.18.0, >=3.1.13.0
  • OpenImageIO/Openimageio3 versions
    cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*range: <3.0.18.0
    • cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*
    • (no CPE)range: >=3.0.18.0, >=3.1.13.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.