CVE-2026-50291

🗓️ 17 Sep 2026 21:33:44Reported by MendType

Invalid palette read in OpenImageIO processing crafted BMP files causes DoS.

Reporter	Title	Published	Views	Family All 13
CVE	CVE-2026-50291	17 Sep 202621:33	–	cve
Cvelist	CVE-2026-50291 OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)	17 Sep 202621:33	–	cvelist
Debian CVE	CVE-2026-50291	17 Sep 202621:33	–	debiancve
EUVD	EUVD-2026-82558	17 Sep 202621:33	–	euvd
NVD	CVE-2026-50291	17 Sep 202622:16	–	nvd
OSV	DEBIAN-CVE-2026-50291	17 Sep 202622:16	–	osv
OSV	UBUNTU-CVE-2026-50291	17 Sep 202622:16	–	osv
Positive Technologies	PT-2026-95134	17 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-50291: Out-of-bounds Read	17 Sep 202600:00	–	rapid7
RedhatCVE	CVE-2026-50291	23 Sep 202609:02	–	redhatcve

Vulners

Node

openimageio openimageioRange3.1.6.1–3.1.11.0

openimageio openimageioRange3.0.0.3–3.0.16.0

Source	Link
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/pull/5030
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-50291
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.11.0
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.0.16.0
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/commit/ee3370d004d5895554239b4302c59eedb721f086
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/commit/be984856e315e0a82cd866745b544c8c4cb8bd45
github	www.github.com/AcademySoftwareFoundation/OpenImageIO/commit/91500ed58ce927b7e710c6bbc3b7f795bb0791b5
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50291.json

12 Oct 2026 16:57Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.5

CVSS 46.8

EPSS0.00199

SSVC