OpenImageIO CVE-2026-43908

Requires user interaction (UI:R per CVSS vector) to process attacker-supplied CbYCrY format image files through applications using vulnerable OpenImageIO versions. Specifically targets the ConvertCbYCrYToRGB() color space conversion function, meaning exploitation occurs only when processing images that invoke this conversion pathway - not all image formats or workflows trigger the vulnerable code. No authentication required (PR:N) for network-based delivery scenarios where attackers can supply images to targets via email attachments, cloud storage shares, web uploads, or collaborative asset management systems. Limiting factors include: user must actively open or process the malicious image rather than passive exploitation, victim application must be compiled against or dynamically linked with OpenImageIO versions prior to patched releases (3.0.18.0/3.1.13.0), and memory corruption exploitability depends on target system memory layout and protection mechanisms (ASLR, DEP) which may reduce code execution likelihood while crash/DoS remains achievable.

CVSS 8.8 (High) reflects network-deliverable attack vector with low complexity, but requires user interaction (UI:R) - a realistic constraint in VFX workflows where artists routinely process third-party image assets. The vulnerability enables high-impact outcomes: confidentiality, integrity, and availability compromise through memory corruption. EPSS probability data unavailable for risk quantification. Not listed in CISA KEV, indicating no confirmed active exploitation campaigns. GitHub security advisory confirms vulnerability and patch availability, establishing high confidence in technical details. Real-world risk depends heavily on deployment context: automated image processing pipelines (render farms, asset ingestion systems) face higher exposure than interactive workstation use. Attack complexity is low (AC:L) once a malicious image is crafted, but weaponization requires understanding CbYCrY format specifics and integer overflow mechanics. Priority assessment: HIGH for internet-facing image processing services and shared rendering infrastructure; MEDIUM for isolated workstation environments with controlled asset sources. No POC publicly identified, reducing immediate weaponization risk, but image file format exploits have established weaponization history in targeted attacks against media/entertainment sectors.

An attacker crafts a malicious CbYCrY-encoded image file with specific dimensional properties calculated to trigger signed integer overflow during pixel indexing. The victim, a VFX artist or automated asset pipeline, processes this image using an application built with vulnerable OpenImageIO versions. During ConvertCbYCrYToRGB() execution, the overflow produces large negative offsets that write pixel data outside allocated buffer boundaries, corrupting adjacent memory regions and crashing the application or potentially achieving code execution if memory layout is predictable.