Executive brief
OpenColorIO is a standard library used in film and animation software to manage color consistency across different displays and formats. A security flaw allows a specially crafted color lookup table (LUT) file to crash the software or potentially allow an attacker to take control of the system when the file is opened. This could lead to data loss, system instability, or unauthorized access to workstations used by digital artists and editors.
Technical details
A stack-based buffer overflow exists in `FileFormatSpi3D.cpp` due to the use of `sscanf` with unbounded `%s` format specifiers. While the application reads lines into a 4096-byte `lineBuffer`, it attempts to parse string tokens into 64-byte stack buffers (`redValueS`, `greenValueS`, `blueValueS`). An attacker can provide a crafted .spi3d file containing tokens exceeding 63 characters to overflow the stack by approximately 4000 bytes. This vulnerability is reachable through any application or tool using the OpenColorIO API to load LUT files. The issue is addressed in version 2.5.2 by implementing width limits in the `sscanf` format string.
Affected products
- AcademySoftwareFoundation OpenColorIO < 2.5.2
Timeline
- 2026-05-13: patched: Version 2.5.2 released
- 2026-06-24: disclosed: CVE-2026-42450 published