CVE-2026-43909: falha de alta gravidade em AcademySoftwareFoundation OpenImageIO
OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.4%
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in the loop index expression i * 4 inside SwapRGBABytes() causes the function to compute a large negative pointer offset when processing kABGR DPX images with large dimensions. The immediate crash is an out-of-bounds read (the memcpy at line 45 reads from &input[i * 4] first), but the subsequent write operations at lines 46–49 target the same wrapped offset — making this a combined OOB read+write primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
AcademySoftwareFoundation · OpenImageIOCVEs relacionadas — AcademySoftwareFoundation OpenImageIO
No mesmo produto, das mais perigosas para as menos.
CVE-2026-63638HIGHOpenImageIO: Cineon invalid bit depth heap out-of-bounds writeEPSS 0.5%CVE-2024-40630MEDIUMHEIF Heap OOB Read in OpenImageIOEPSS 0.4%CVE-2026-65970MEDIUMOpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`EPSS 0.4%CVE-2026-43908HIGHOpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoderEPSS 0.4%CVE-2026-43907HIGHOpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)EPSS 0.4%CVE-2026-59156MEDIUMOpenImageIO: Unbounded recursion in FITS header parser leads to stack overflowEPSS 0.4%