OpenImageIO CVE-2026-59156

Exploitation requires that a target application or service using OpenImageIO (prior to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1) reads/parses an attacker-supplied FITS-format file. The specific trigger is a FITS stream containing consecutive 2880-byte header blocks that omit the mandatory END keyword, causing FitsInput::read_fits_header() in src/fits.imageio/fitsinput.cpp to recurse without a depth bound. Limiting factors: the victim must actually open/ingest the crafted file (UI:R), impact is limited to a crash of the parsing process (availability only, no code execution or data exposure), and installations on fixed versions are not affected. Practical exposure depends on whether the deployment accepts untrusted image uploads or processes external FITS assets automatically.

This is a genuine but bounded-severity denial-of-service issue, not a high-priority remote-code-execution threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and CWE-674 (Uncontrolled Recursion) agree with the description: a crafted FITS image file drives FitsInput::read_fits_header() into unbounded self-recursion, exhausting the application stack and crashing the process. Impact is availability-only (C:N/I:N) - no data disclosure, no code execution, no scope change. The network vector (AV:N) is nominal for a file-parsing library: 'network' realistically means the crafted file is delivered to an application/service that embeds OpenImageIO, and UI:R correctly reflects that a user or automated pipeline must actually open/process the file. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. Net: a real, easily-triggered crash that is worth patching in VFX/render pipelines, but the absence of confidentiality/integrity impact and of any exploitation signal keeps it a moderate-priority hygiene fix rather than an emergency.

An attacker crafts a malicious FITS file consisting of consecutive 2880-byte header blocks that never contain the mandatory END keyword, then delivers it to any application, render farm, or asset-ingestion service that uses OpenImageIO to read images. When the file is opened, read_fits_header() recurses without a depth bound until the stack is exhausted and the process crashes. No public proof-of-concept is referenced, but the trigger is precisely described in the advisory and the fix diff, making reproduction straightforward.