Quick answers
- Is CVE-2026-43996 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43996 being exploited in the wild.
- How severe is CVE-2026-43996?
- Medium severity, with a CVSS score of 5.5, published 14 May 2026.
- Which products and versions are affected?
- Academy Software Foundation OpenImageIO < 3.0.18.0, < 3.1.13.0, <= 3.2.0.1-dev.
- Is there a fix for CVE-2026-43996?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-43996 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-43996?
- Check whether you run Academy Software Foundation OpenImageIO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An integer wraparound vulnerability exists in TGAInput::decode_pixel within OpenImageIO. The bounds check for palette access performs 32-bit unsigned arithmetic (k + palbytespp). When k is a large value such as 0xFFFFFFFC and palbytespp is 4, the result wraps to 0, bypassing the check against palette_alloc_size. The subsequent memory access uses the original large value of k as an index, resulting in an out-of-bounds read of approximately 4GB past the buffer, causing a segmentation fault (SEGV). This issue is triggered by processing a malformed TGA file with a crafted palette index. The vulnerability is fixed in versions 3.0.18.0 and 3.1.13.0.
Affected products
- Academy Software Foundation OpenImageIO < 3.0.18.0, < 3.1.13.0, <= 3.2.0.1-dev
Timeline
- 2026-05-03: advisory: GitHub advisory GHSA-mq8j-73c4-cr55 published
- 2026-05-14: disclosed: CVE-2026-43996 published