OpenImageIO CVE-2026-113681

Exploitation requires the victim to open or process an attacker-supplied Cineon-format image file using OpenImageIO's Cineon reader (cineon::Codec::Read / UnPackPacked); the malicious file must declare an extremely large width that wraps the scanline buffer size calculation to zero. Limiting factors: this is a local vector (AV:L) requiring user interaction (UI:P) to load the crafted file, affects only the Cineon image path, and the impact is limited to a crash (out-of-bounds READ, availability only) with no code execution or data disclosure. Affected builds are OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1.

This is a medium-severity denial-of-service issue, not a high-priority emergency. The vendor-assigned CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H, base 6.8) tells a consistent story: the only impact is availability (VA:H) - a heap out-of-bounds READ that crashes the process - with no confidentiality or integrity impact (VC:N/VI:N). CWE-190 (integer overflow) matches the described width wrap-to-zero that undersizes the scanline buffer. The vector is local (AV:L) and requires passive user interaction (UI:P), meaning a victim must open or process an attacker-supplied Cineon file; it is not remotely reachable without that step. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so this is not confirmed to be actively exploited and there is no public exploit identified at time of analysis. The realistic risk is a parser crash (DoS) in media/VFX pipelines that batch-process untrusted image files; because the impact is a read-based crash rather than code execution, the practical priority is moderate. One nuance to verify: the vector lists PR:N (unauthenticated) while exploitation inherently depends on a user choosing to process a malicious file - the UI:P metric already captures that limiting factor.

An attacker crafts a malicious Cineon image file declaring a huge width that overflows the scanline buffer size calculation to zero, then delivers it to a victim (e.g., as an asset in a VFX/rendering pipeline or a file sent to an artist). When the victim's application opens the file via OpenImageIO's Cineon reader, UnPackPacked reads past the undersized 4-byte buffer and crashes the application. No public exploit code is identified at time of analysis; the flaw was reported by VulnCheck with a vendor patch available.