# Academy Software Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/academy-software-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/academy-software-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Academy Software Foundation: 0 in the last 7 days and 15 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113681, was published on 20 October 2026. 1 vulnerability in the last four weeks, down 93% on the four before (14). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 15 - All time: 26 (0 critical, 0 exploited in the wild) ## About Academy Software Foundation The Academy Software Foundation provides a neutral forum for open source software developers in the motion picture and broader media industries to share resources and collaborate on technologies. ## Latest Academy Software Foundation vulnerabilities - [CVE-2026-113681: OpenImageIO integer overflow in Cineon codec scanline buffer](https://junglewise.ai/threats/cve-2026-113681-openimageio-before-3-0-20-0-3-1-x-before-3-1-15-0-and-3-2-x) (medium, CVSS 5.5, published 20 Oct 2026) - [CVE-2026-79113: OpenAPV heap-based buffer overflow in read_bitstream](https://junglewise.ai/threats/cve-2026-79113-openapv-before-1-1-1-0-has-a-read-bitstream-heap-based-buffer) (info, published 3 Oct 2026) - [CVE-2026-88384: OpenEXR null pointer dereference in attribute parsing](https://junglewise.ai/threats/cve-2026-88384-openexr-3-4-14-contains-a-null-pointer-dereference-in-the-c) (medium, CVSS 5.5, published 24 Sep 2026) - [CVE-2026-67549: OpenImageIO heap overflow in TIFF CMYK decoding](https://junglewise.ai/threats/cve-2026-67549-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.6, published 18 Sep 2026) - [CVE-2026-65970: OpenImageIO use-after-scope in multithreaded TIFF decompression](https://junglewise.ai/threats/cve-2026-65970-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-65969: OpenImageIO integer overflow in GIF palette splitting](https://junglewise.ai/threats/cve-2026-65969-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63638: OpenImageIO heap overflow in cineon image parsing](https://junglewise.ai/threats/cve-2026-63638-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 8.3, published 18 Sep 2026) - [CVE-2026-63635: OpenImageIO out-of-bounds read in PSD parser](https://junglewise.ai/threats/cve-2026-63635-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63422: OpenImageIO heap overflow in OpenEXR partial tile reading](https://junglewise.ai/threats/cve-2026-63422-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-63420: OpenImageIO heap out-of-bounds read in PSD processing](https://junglewise.ai/threats/cve-2026-63420-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 5.5, published 18 Sep 2026) - [CVE-2026-63419: OpenImageIO heap out-of-bounds write in IFF decoder](https://junglewise.ai/threats/cve-2026-63419-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-59956: OpenImageIO heap buffer over-read in IFF image parsing](https://junglewise.ai/threats/cve-2026-59956-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-59181: OpenImageIO buffer overflow in Cineon image parsing](https://junglewise.ai/threats/cve-2026-59181-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.1, published 18 Sep 2026) - [CVE-2026-59156: OpenImageIO stack overflow in FITS header parsing](https://junglewise.ai/threats/cve-2026-59156-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-50291: OpenImageIO BMP palette denial of service](https://junglewise.ai/threats/cve-2026-50291-openimageio-bmp-palette-denial-of-service) (medium, CVSS 5.5, published 17 Sep 2026) - [CVE-2025-64181: PYSEC-2026-2843 - OpenEXR Makes Use of Uninitialized Memory](https://junglewise.ai/threats/cve-2025-64181-openexr-use-of-uninitialized-memory-in-generic-unpack) (low, CVSS 3.1, published 13 Jul 2026) - [CVE-2026-42450: OpenColorIO stack buffer overflow in Spi3D LUT parser](https://junglewise.ai/threats/cve-2026-42450-opencolorio-stack-buffer-overflow-in-spi3d-lut-parser) (info, CVSS 8.4, published 24 Jun 2026) - [CVE-2026-43996: OpenImageIO out-of-bounds read in TGAInput decode_pixel](https://junglewise.ai/threats/cve-2026-43996-openimageio-out-of-bounds-read-in-tgainput-decode-pixel) (medium, CVSS 5.5, published 14 May 2026) - [CVE-2026-43909: OpenImageIO integer overflow in SwapRGBABytes DPX decoder](https://junglewise.ai/threats/cve-2026-43909-openimageio-integer-overflow-in-swaprgbabytes-dpx-decoder) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43908: OpenImageIO integer overflow in ConvertCbYCrYToRGB](https://junglewise.ai/threats/cve-2026-43908-openimageio-integer-overflow-in-convertcbycrytorgb) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43907: OpenImageIO heap overflow in DPX decoder](https://junglewise.ai/threats/cve-2026-43907-openimageio-heap-overflow-in-dpx-decoder) (high, CVSS 8.3, published 14 May 2026) - [CVE-2026-43906: OpenImageIO heap buffer overflow in HEIF decoder](https://junglewise.ai/threats/cve-2026-43906-openimageio-heap-buffer-overflow-in-heif-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43905: OpenImageIO heap overflow in JPEG2000 reader](https://junglewise.ai/threats/cve-2026-43905-openimageio-heap-overflow-in-jpeg2000-reader) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43904: OpenImageIO heap overflow in Softimage PIC RLE decoder](https://junglewise.ai/threats/cve-2026-43904-openimageio-heap-overflow-in-softimage-pic-rle-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43903: OpenImageIO heap buffer overflow in SGI RLE decoder](https://junglewise.ai/threats/cve-2026-43903-openimageio-heap-buffer-overflow-in-sgi-rle-decoder) (high, CVSS 7.8, published 14 May 2026) ## Most severe Academy Software Foundation vulnerabilities - [CVE-2026-43909: OpenImageIO integer overflow in SwapRGBABytes DPX decoder](https://junglewise.ai/threats/cve-2026-43909-openimageio-integer-overflow-in-swaprgbabytes-dpx-decoder) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-43908: OpenImageIO integer overflow in ConvertCbYCrYToRGB](https://junglewise.ai/threats/cve-2026-43908-openimageio-integer-overflow-in-convertcbycrytorgb) (high, CVSS 8.8, published 14 May 2026) - [CVE-2026-63638: OpenImageIO heap overflow in cineon image parsing](https://junglewise.ai/threats/cve-2026-63638-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 8.3, published 18 Sep 2026) - [CVE-2026-43907: OpenImageIO heap overflow in DPX decoder](https://junglewise.ai/threats/cve-2026-43907-openimageio-heap-overflow-in-dpx-decoder) (high, CVSS 8.3, published 14 May 2026) - [CVE-2026-27622: OpenEXR heap out-of-bounds write in CompositeDeepScanLine](https://junglewise.ai/threats/cve-2026-27622-openexr-heap-out-of-bounds-write-in-compositedeepscanline) (high, CVSS 7.8, published 3 Mar 2026) - [CVE-2026-63422: OpenImageIO heap overflow in OpenEXR partial tile reading](https://junglewise.ai/threats/cve-2026-63422-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-63419: OpenImageIO heap out-of-bounds write in IFF decoder](https://junglewise.ai/threats/cve-2026-63419-openimageio-is-a-toolset-for-reading-writing-and-manipulating) (high, CVSS 7.8, published 18 Sep 2026) - [CVE-2026-43906: OpenImageIO heap buffer overflow in HEIF decoder](https://junglewise.ai/threats/cve-2026-43906-openimageio-heap-buffer-overflow-in-heif-decoder) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43905: OpenImageIO heap overflow in JPEG2000 reader](https://junglewise.ai/threats/cve-2026-43905-openimageio-heap-overflow-in-jpeg2000-reader) (high, CVSS 7.8, published 14 May 2026) - [CVE-2026-43904: OpenImageIO heap overflow in Softimage PIC RLE decoder](https://junglewise.ai/threats/cve-2026-43904-openimageio-heap-overflow-in-softimage-pic-rle-decoder) (high, CVSS 7.8, published 14 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 93% on the four before (14). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 12 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Academy Software Foundation technologies - [Academy Software Foundation OpenImageIO](https://junglewise.ai/threats/technologies/openimageio): 21 vulnerabilities - [Academy Software Foundation OpenEXR](https://junglewise.ai/threats/technologies/academy-software-foundation-openexr): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Academy Software Foundation vulnerabilities", https://junglewise.ai/threats/vendors/academy-software-foundation, 9 November 2026.