Executive brief
OpenImageIO is a widely-used image processing library used in animation and VFX production. A crafted BMP file can cause the library to crash when processing RLE-compressed image data, disrupting any application or tool that uses it to read images and potentially halting production workflows.
Technical details
The vulnerability exists in the BMP image decoder (src/bmp.imageio/bmpinput.cpp) where processing a crafted BMP file with an empty color table can lead to an invalid palette read during RLE scanline decoding in BmpInput::read_native_scanline. The root cause is insufficient validation of palette presence before attempting to access palette entries. An attacker can trigger a process crash (denial of service) by supplying a malicious BMP file to oiiotool or any application linked to the library. The vulnerability affects versions prior to 3.0.16.0 and 3.1.11.0, and patches are available in those versions.
Affected products
- Academy Software Foundation OpenImageIO before 3.0.16.0 and before 3.1.11.0
Timeline
- 2026-09-17: disclosed