Executive brief
OpenImageIO is a widely used library for reading and processing image files in the visual effects and animation industries. A security flaw allows a specially crafted SGI image file to cause a memory error when opened, potentially leading to a system crash or unauthorized code execution. This affects any application using the library to process images, such as media players or rendering software.
Technical details
A heap buffer overflow exists in the SGI RLE (Run-Length Encoding) decoder within `sgiinput.cpp`. The vulnerability stems from the use of `OIIO_DASSERT` for bounds checking in the RLE decode loop; in release builds, this macro evaluates to a no-op, effectively removing all safety checks. An attacker can craft an SGI file with an RLE count that exceeds the scanline width, leading to an out-of-bounds write to the heap. This can result in memory corruption, application crashes, or potential code execution. The issue is fixed in versions 3.0.18.0, 3.1.13.0, and 3.2.0.2 by replacing assertions with mandatory runtime checks.
Affected products
- Academy Software Foundation OpenImageIO < 3.0.18.0, < 3.1.13.0, < 3.2.0.2
Timeline
- 2026-05-03: advisory: GitHub advisory published by maintainer
- 2026-05-14: disclosed: CVE published to NVD