Executive brief
OpenImageIO is a widely used library for reading and processing image files in the visual effects and animation industries. A vulnerability in how it handles DPX image files could allow an attacker to crash an application or potentially execute malicious code. This occurs when the software is tricked into allocating too little memory for a specially crafted image, leading to a memory corruption. Organizations using this library should update to the latest patched versions to prevent potential system compromise or service disruptions.
Technical details
A signed integer overflow exists in the QueryRGBBufferSizeInternal() function within DPXColorConverter.cpp. The function uses 32-bit signed arithmetic with negative multipliers to calculate buffer sizes; for large pixel counts, this calculation overflows and wraps to a small positive value. The caller in dpxinput.cpp interprets this positive value as a valid buffer size and allocates an undersized heap buffer via m_decodebuf.resize(). Subsequent file read operations via fread write the full image data into the undersized buffer, causing a heap buffer overflow. This can be triggered by a remote attacker providing a crafted DPX file, requiring minimal user interaction (opening the file). The issue is fixed in versions 3.0.18.0 and 3.1.13.0.
Affected products
- Academy Software Foundation OpenImageIO < 3.0.18.0, < 3.1.13.0
Timeline
- 2026-05-03: advisory: GitHub advisory published by maintainers
- 2026-05-14: disclosed: CVE published to NVD