Is CVE-2026-42450 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42450 being exploited in the wild.

How severe is CVE-2026-42450?

Informational severity, with a CVSS score of 8.4, published 24 June 2026.

Which products and versions are affected?

Academy Software Foundation OpenColorIO < 2.5.2.

Is there a fix for CVE-2026-42450?

A patch was published on 2026-05-13: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42450 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-42450?

Check whether you run Academy Software Foundation OpenColorIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42450: OpenColorIO stack buffer overflow in Spi3D LUT parser

Q: Is there a fix for CVE-2026-42450?

A patch was published on 2026-05-13: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42450 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-42450?

Check whether you run Academy Software Foundation OpenColorIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42450 · Severity: info · CVSS 8.4 · Published 2026-06-24

OpenColorIO is a standard library used in film and animation software to manage color consistency across different displays and formats. A security flaw allows a specially crafted color lookup table (LUT) file to crash the software or potentially allow an attacker to take control of the system when the file is opened. This could lead to data loss, system instability, or unauthorized access to workstations used by digital artists and editors.

Vendors: Academy Software Foundation.

Quick answers

Is CVE-2026-42450 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42450 being exploited in the wild.
How severe is CVE-2026-42450?: Informational severity, with a CVSS score of 8.4, published 24 June 2026.
Which products and versions are affected?: Academy Software Foundation OpenColorIO < 2.5.2.
Is there a fix for CVE-2026-42450?: A patch was published on 2026-05-13: Version 2.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42450 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-42450?: Check whether you run Academy Software Foundation OpenColorIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in `FileFormatSpi3D.cpp` due to the use of `sscanf` with unbounded `%s` format specifiers. While the application reads lines into a 4096-byte `lineBuffer`, it attempts to parse string tokens into 64-byte stack buffers (`redValueS`, `greenValueS`, `blueValueS`). An attacker can provide a crafted .spi3d file containing tokens exceeding 63 characters to overflow the stack by approximately 4000 bytes. This vulnerability is reachable through any application or tool using the OpenColorIO API to load LUT files. The issue is addressed in version 2.5.2 by implementing width limits in the `sscanf` format string.

Affected products

AcademySoftwareFoundation OpenColorIO < 2.5.2

Timeline

2026-05-13: patched: Version 2.5.2 released
2026-06-24: disclosed: CVE-2026-42450 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.