# Academy Software Foundation OpenImageIO vulnerabilities Source: https://junglewise.ai/threats/technologies/openimageio Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/openimageio.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Academy Software Foundation OpenImageIO: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113681, was published on 20 October 2026. 1 vulnerability in the last four weeks, down 92% on the four before (12). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 13 - All time: 21 (0 critical, 0 exploited in the wild) ## About Academy Software Foundation OpenImageIO C++ library for reading and writing images in multiple formats with support for custom plugins. ## Latest Academy Software Foundation OpenImageIO vulnerabilities - [CVE-2026-113681: OpenImageIO integer overflow in Cineon codec scanline buffer](https://junglewise.ai/threats/cve-2026-113681-openimageio-before-3-0-20-0-3-1-x-before-3-1-15-0-and-3-2-x) (medium, CVSS 5.5, published 20 Oct 2026) - [CVE-2026-67549: OpenImageIO heap overflow in TIFF CMYK decoding](https://junglewise.ai/threats/cve-2026-67549-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.6, published 18 Sep 2026) - [CVE-2026-65970: OpenImageIO use-after-scope in multithreaded TIFF decompression](https://junglewise.ai/threats/cve-2026-65970-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-65969: OpenImageIO integer overflow in GIF palette splitting](https://junglewise.ai/threats/cve-2026-65969-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63638: OpenImageIO heap overflow in cineon image parsing](https://junglewise.ai/threats/cve-2026-63638-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 8.3, published 18 Sep 2026) - [CVE-2026-63635: OpenImageIO out-of-bounds read in PSD parser](https://junglewise.ai/threats/cve-2026-63635-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63422: OpenImageIO heap overflow in OpenEXR partial tile reading](https://junglewise.ai/threats/cve-2026-63422-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-63420: OpenImageIO heap out-of-bounds read in PSD processing](https://junglewise.ai/threats/cve-2026-63420-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63419: OpenImageIO heap out-of-bounds write in IFF decoder](https://junglewise.ai/threats/cve-2026-63419-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-59956: OpenImageIO heap buffer over-read in IFF image parsing](https://junglewise.ai/threats/cve-2026-59956-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-59181: OpenImageIO buffer overflow in Cineon image parsing](https://junglewise.ai/threats/cve-2026-59181-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-59156: OpenImageIO stack overflow in FITS header parsing](https://junglewise.ai/threats/cve-2026-59156-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-50291: OpenImageIO BMP palette denial of service](https://junglewise.ai/threats/cve-2026-50291-openimageio-bmp-palette-denial-of-service) (medium, CVSS 5.5, published 17 Sep 2026) - [CVE-2026-43996: OpenImageIO out-of-bounds read in TGAInput decode_pixel](https://junglewise.ai/threats/cve-2026-43996-openimageio-out-of-bounds-read-in-tgainput-decode-pixel) (medium, CVSS 5.5, published 14 May 2026) - [CVE-2026-43909: OpenImageIO integer overflow in SwapRGBABytes DPX decoder](https://junglewise.ai/threats/cve-2026-43909-openimageio-integer-overflow-in-swaprgbabytes-dpx-decoder) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43908: OpenImageIO integer overflow in ConvertCbYCrYToRGB](https://junglewise.ai/threats/cve-2026-43908-openimageio-integer-overflow-in-convertcbycrytorgb) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43907: OpenImageIO heap overflow in DPX decoder](https://junglewise.ai/threats/cve-2026-43907-openimageio-heap-overflow-in-dpx-decoder) (high, CVSS 8.3, published 14 May 2026) - [CVE-2026-43906: OpenImageIO heap buffer overflow in HEIF decoder](https://junglewise.ai/threats/cve-2026-43906-openimageio-heap-buffer-overflow-in-heif-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43905: OpenImageIO heap overflow in JPEG2000 reader](https://junglewise.ai/threats/cve-2026-43905-openimageio-heap-overflow-in-jpeg2000-reader) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43904: OpenImageIO heap overflow in Softimage PIC RLE decoder](https://junglewise.ai/threats/cve-2026-43904-openimageio-heap-overflow-in-softimage-pic-rle-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43903: OpenImageIO heap buffer overflow in SGI RLE decoder](https://junglewise.ai/threats/cve-2026-43903-openimageio-heap-buffer-overflow-in-sgi-rle-decoder) (high, CVSS 7.8, published 14 May 2026) ## Most severe Academy Software Foundation OpenImageIO vulnerabilities - [CVE-2026-43909: OpenImageIO integer overflow in SwapRGBABytes DPX decoder](https://junglewise.ai/threats/cve-2026-43909-openimageio-integer-overflow-in-swaprgbabytes-dpx-decoder) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43908: OpenImageIO integer overflow in ConvertCbYCrYToRGB](https://junglewise.ai/threats/cve-2026-43908-openimageio-integer-overflow-in-convertcbycrytorgb) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-63638: OpenImageIO heap overflow in cineon image parsing](https://junglewise.ai/threats/cve-2026-63638-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 8.3, published 18 Sep 2026) - [CVE-2026-43907: OpenImageIO heap overflow in DPX decoder](https://junglewise.ai/threats/cve-2026-43907-openimageio-heap-overflow-in-dpx-decoder) (high, CVSS 8.3, published 14 May 2026) - [CVE-2026-63422: OpenImageIO heap overflow in OpenEXR partial tile reading](https://junglewise.ai/threats/cve-2026-63422-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-63419: OpenImageIO heap out-of-bounds write in IFF decoder](https://junglewise.ai/threats/cve-2026-63419-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-43906: OpenImageIO heap buffer overflow in HEIF decoder](https://junglewise.ai/threats/cve-2026-43906-openimageio-heap-buffer-overflow-in-heif-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43905: OpenImageIO heap overflow in JPEG2000 reader](https://junglewise.ai/threats/cve-2026-43905-openimageio-heap-overflow-in-jpeg2000-reader) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43904: OpenImageIO heap overflow in Softimage PIC RLE decoder](https://junglewise.ai/threats/cve-2026-43904-openimageio-heap-overflow-in-softimage-pic-rle-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43903: OpenImageIO heap buffer overflow in SGI RLE decoder](https://junglewise.ai/threats/cve-2026-43903-openimageio-heap-buffer-overflow-in-sgi-rle-decoder) (high, CVSS 7.8, published 14 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 92% on the four before (12). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 12 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Academy Software Foundation technologies - [Academy Software Foundation OpenEXR](https://junglewise.ai/threats/technologies/academy-software-foundation-openexr): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Academy Software Foundation OpenImageIO vulnerabilities", https://junglewise.ai/threats/technologies/openimageio, 11 November 2026.