CVE-2024-40630

OpenImageIO is a toolset for reading, writing, and manipulating image files
of any image file format relevant to VFX / animation via a format-agnostic
API with a feature set, scalability, and robustness needed for feature film
production. In affected versions there is a bug in the heif input
functionality of OpenImageIO. Specifically, in
HeifInput::seek_subimage(). In the worst case, this can lead to an
information disclosure vulnerability, particularly for programs that
directly use the ImageInput APIs. This bug has been addressed in commit
0a2dcb4c which is included in the 2.5.13.1 release. Users are advised to
upgrade. There are no known workarounds for this issue.