Executive brief
OpenImageIO is a widely used library for processing image files in the visual effects and animation industries. A security flaw in how it handles JPEG2000 images allows a specially crafted image file to crash the software or potentially allow an attacker to run unauthorized code. This could lead to data theft or system compromise if a user is tricked into opening a malicious image file.
Technical details
An integer overflow vulnerability exists in `jpeg2000input.cpp` within OpenImageIO when compiled with the `USE_OPENJPH` flag. The library calculates the required buffer size for JPEG2000 images using signed 32-bit arithmetic (`w * h * ch * buffer_bpp`). When processing images with very large dimensions, this product can exceed `INT_MAX`, causing a wraparound to zero or a small value. Consequently, `m_buf.resize()` allocates an undersized buffer, while subsequent pixel write loops use the original large dimensions, resulting in a heap buffer overflow. Additionally, the JPEG2000 reader fails to call `check_open()`, bypassing global image size protections. The issue is fixed in versions 3.0.18.0 and 3.1.13.0.
Affected products
- Academy Software Foundation (ASWF) OpenImageIO < 3.0.18.0, < 3.1.13.0
Timeline
- 2026-05-03: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD