CVE-2026-43909

OpenImageIO contains a signed 32-bit overflow in SwapRGBABytes()’s loop (i * 4) when processing kABGR DPX images with large dimensions, causing a large negative pointer offset and resulting in a combined OOB read/write (reads from &input[i * 4], writes to the wrapped offset). This affects prior t...

CVE-2026-43909 OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i 4 inside SwapRGBABytes causes the function to compute a large negative...