Fedora 44 : OpenImageIO (2026-25954ebccf)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-25954ebccf advisory. https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.15.0 Tenable has extracted the preceding description block directly from...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS : OpenImageIO vulnerabilities (USN-8438-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8438-1 advisory. It was discovered that OpenImageIO incorrectly performed bounds checking when processing SGI files. An...

USN-8438-1: OpenImageIO vulnerabilities

It was discovered that OpenImageIO incorrectly performed bounds checking when processing SGI files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-43903 It was discovered that OpenImageIO incorrectly handled run-length encoding when...

MGASA-2026-0206 Updated openimageio packages fix security vulnerability

AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write. CVE-2026-7582...

Updated openimageio packages fix security vulnerability

AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write. CVE-2026-7582...

OPENSUSE-SU-2026:10918-1 OpenImageIO-3.1.14.0-1.1 on GA media

These are all security issues fixed in the OpenImageIO-3.1.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the SwapRGBABytes() function in the OpenImageIO library, which allows a hacker to cause a service failure.

The vulnerability of the SwapRGBABytes function in the OpenImageIO library is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the QueryRGBBufferSizeInternal() function in the OpenImageIO library allows a hacker to cause a service failure.

The vulnerability of the QueryRGBBufferSizeInternal function in the OpenImageIO library is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

SUSE CVE-2026-43903

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use OIIODASSERT for bounds checking in the RLE decode loop. In release builds, OIIODASSERT compiles to voidsizeofx...

SUSE CVE-2026-43904

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 mixed RLE and :345 pure RLE do not clamp the run length to remaining scanline width before writing pixels. The r...

SUSE CVE-2026-43905

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w h ch bufferbpp using signed 32-bit arithmetic. When the product...

SUSE CVE-2026-43906

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metada...

SUSE CVE-2026-43908

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the pixel-loop index expression i 3 inside ConvertCbYCrYToRGB causes the function to compute a larg...

SUSE CVE-2026-43996

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, the bounds check in TGAInput::decodepixel computes k + palbytespp as unsigned 32-bit arithmetic. When k = 0xFFFFFFFC and palbytespp = 4...

CVE-2026-43908

A flaw was found in OpenImageIO. A signed 32-bit integer overflow in the ConvertCbYCrYToRGB function can lead to an out-of-bounds write. A remote attacker could exploit this by convincing a user to process a specially crafted image file, resulting in a denial of service DoS due to a process crash...

CVE-2026-43996

A flaw was found in OpenImageIO. An integer overflow vulnerability exists in the TGAInput::decodepixel function's bounds check. This flaw allows a local attacker, by enticing a user to process a specially crafted image file, to cause an out-of-bounds read, leading to a segmentation fault and a...

CVE-2026-43907

A flaw was found in OpenImageIO. A remote attacker can exploit a signed integer overflow vulnerability by providing a specially crafted DPX image file. This flaw leads to a heap-based out-of-bounds write, which can result in a denial of service crash or potentially arbitrary code execution in...

CVE-2026-43909

A flaw was found in OpenImageIO. A signed 32-bit integer overflow in the SwapRGBABytes function, triggered when processing kABGR DPX images with large dimensions, can lead to an out-of-bounds read and write. This allows a remote attacker to potentially execute arbitrary code or cause a denial of...

CVE-2026-43904

A flaw was found in OpenImageIO. When processing a specially crafted .pic image file, the software fails to properly clamp the run length during Run Length Encoding RLE image processing. This oversight can lead to a heap overflow, allowing a remote attacker to potentially execute arbitrary code,...

CVE-2026-43905

A flaw was found in OpenImageIO. When processing a specially crafted JPEG2000 image file, an internal calculation for buffer size can result in an integer overflow. This leads to an undersized memory allocation, causing a heap overflow. An attacker could exploit this to potentially execute...