OpenImageIO CVE-2026-43909

Exploitation requires the victim to open a specially crafted DPX image file using an application that utilizes vulnerable OpenImageIO versions (pre-3.0.18.0 or pre-3.1.13.0) for image decoding. The malicious file must be in kABGR DPX format with image dimensions engineered to cause signed 32-bit integer overflow in the expression 'i * 4' within the SwapRGBABytes() function - typically width or height values that result in a total pixel count causing the loop index multiplied by 4 to exceed 2,147,483,647. Exploitation is LIMITED by required user interaction (UI:R in CVSS vector) - the file must be actively opened/processed by the victim, not merely delivered. Network vector (AV:N) reflects delivery via email, web download, shared storage, or supply chain injection into content repositories. No authentication (PR:N) or privileged access is required for the attacker to create or deliver the malicious file, but successful exploitation depends on victim action. The vulnerability affects default OpenImageIO configurations with DPX format support enabled, which is standard in VFX/animation industry deployments. Platform-agnostic - affects Linux, Windows, and macOS builds of OpenImageIO equally.

Real-world risk is MODERATE despite the 8.8 CVSS score, reflecting several constraining factors. CVSS indicates network vector (AV:N) and no authentication required (PR:N), but the mandatory user interaction (UI:R) limits this to social engineering scenarios where victims must actively open a malicious DPX file in OpenImageIO-based applications. Attack complexity is low (AC:L) once delivery succeeds, with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). No EPSS score is available to quantify exploitation probability, and the vulnerability is NOT in CISA KEV, suggesting no confirmed widespread or targeted exploitation as of analysis date. However, the vendor-initiated disclosure via GitHub Security Advisory (GHSA-g267-j53j-5258) and the specificity of the DPX format targeting indicate this may be of interest to adversaries focused on media/entertainment supply chains or VFX studio intellectual property theft. The read+write primitive is more severe than a simple crash, potentially enabling shellcode execution if combined with memory layout knowledge. Priority should be HIGH for organizations in media production, film post-production, and animation sectors using OpenImageIO in rendering pipelines or asset management systems; MEDIUM for general IT environments where user-facing image processing occurs.

An attacker crafts a malicious DPX image file with dimensions calculated to trigger signed integer overflow in the SwapRGBABytes() loop index (e.g., width=1,073,741,824 pixels, height=1, causing 'i * 4' to wrap when i exceeds 536,870,911). The attacker delivers this file to a VFX artist via email attachment disguised as dailies footage or delivers it through a compromised stock footage website. When the victim opens the file in a compositing application using vulnerable OpenImageIO versions (Nuke, Blender, custom pipeline tools), the negative pointer offset causes memcpy to read from and write to arbitrary memory locations. With precise offset tuning and knowledge of the application's memory layout, the attacker achieves code execution in the context of the rendering process, potentially exfiltrating unreleased film content or installing persistence mechanisms in the artist workstation.