EUVD-2026-30398Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver crafted JPEG 2000 file
-
DeliveryUser opens image in VFX application
-
ExploitInteger overflow in buffer calculation
-
InstallUndersized heap allocation
-
C2Pixel write loop overflows buffer
-
ExecuteHeap memory corruption
-
ImpactArbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires OpenImageIO compiled with USE_OPENJPH build flag enabled - this is a non-default optional codec. Attack requires local access to deliver malicious JPEG 2000 image file and user interaction to open the file (UI:A per CVSS). User must process the crafted image through an application using the vulnerable OpenImageIO library. Standard default builds without OpenJPH support are not exploitable. Attack complexity is low (AC:L) once conditions are met, but attack requirements present (AT:P) due to specific build configuration dependency. |
| Impact | Real-world risk is moderate despite CVSS 7.1 score. CVSS vector CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A indicates local attack vector requiring user interaction (opening malicious image), low attack complexity, but present attack requirements. SSVC framework confirms POC availability and total technical impact (arbitrary code execution), but marks not automatable due to user interaction requirement. This aligns with the UI:A (user interaction required) in CVSS. The vulnerability is exploitable only when USE_OPENJPH is enabled during compilation, significantly reducing the attack surface compared to default builds. No EPSS score provided and no CISA KEV listing indicates this is not being exploited at scale in the wild. Primary risk is to VFX/animation studios and content pipelines that process untrusted JPEG 2000 images using OpenJPH-enabled builds. The local attack vector limits remote exploitation scenarios, requiring social engineering or supply chain compromise to deliver malicious images. Given POC existence and heap corruption primitive, this warrants priority patching for affected installations, but general internet-facing systems are not at immediate risk. |
| Exploit ScenarioDerived | Attacker crafts a malicious JPEG 2000 image file with dimensions carefully chosen so width × height × channels × bytes-per-pixel exceeds INT_MAX, causing integer wraparound to a small buffer size. User opens this image in a VFX application using OpenImageIO compiled with OpenJPH support. During parsing, the undersized heap buffer is allocated, then pixel write loops overflow the buffer, corrupting adjacent heap structures to achieve arbitrary code execution with the privileges of the rendering application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 14, 2026
Heap overflow in OpenImageIO's JPEG 2000 decoder allows local attackers with malicious image files to execute arbitrary code. Affects versions before 3.0.18.0 and 3.1.x before 3.1.13.0 when compiled with USE_OPENJPH flag. Integer overflow in buffer size calculation causes undersized heap allocation, leading to memory corruption during pixel writes. No public exploit identified at time of analysis, but SSVC framework indicates POC exists. Vendor-released patches available in versions 3.0.18.0 and 3.1.13.0.
RemediationAI
Upgrade to OpenImageIO version 3.0.18.0 for the stable branch or 3.1.13.0 for the development branch as documented in GitHub Security Advisory GHSA-pj45-cf3g-28gq at https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-pj45-cf3g-28gq. Both patches implement proper integer overflow checks in jpeg2000input.cpp buffer size calculations. If immediate patching is not feasible, disable USE_OPENJPH at compile time and rebuild without OpenJPH JPEG 2000 codec support, though this eliminates JPEG 2000 format handling capabilities. As compensating control, implement strict input validation to reject JPEG 2000 files with suspicious dimensions (width × height × channels exceeding safe thresholds around 500 million pixels) before passing to OpenImageIO, though this may break legitimate high-resolution content workflows. Restrict processing of JPEG 2000 images to trusted sources only and run OpenImageIO processing in sandboxed environments with limited privileges to contain potential exploitation impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenImageIO is an Academy Software Foundation library for reading and writing image formats used in visual effects and animation pipelines. The vulnerability resides in jpeg2000input.cpp at line 395, where buffer size is computed using signed 32-bit multiplication (w * h * ch * buffer_bpp). When processing maliciously crafted JPEG 2000 images with dimensions that cause this product to exceed INT_MAX (2,147,483,647), integer overflow (CWE-190) causes the result to wrap to zero or a small positive value. The subsequent m_buf.resize() allocates an undersized heap buffer, but pixel write loops proceed assuming the full calculated size, writing beyond allocated bounds and corrupting heap memory. This vulnerability only manifests in builds compiled with the USE_OPENJPH build flag, which enables OpenJPH JPEG 2000 codec support. CPE cpe:2.3:a:academysoftwarefoundation:openimageio identifies the affected component from the Academy Software Foundation.
Know when Openimageio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w * h * ch * buffer_bpp using signed 32-bit arithmetic. When the product exceeds INT_MAX, the result wraps to 0 or a small value. m_buf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USE_OPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
Executive ViewAI
OpenImageIO versions before 3.0.18.0 and 3.1.x before 3.1.13.0 contain a heap overflow vulnerability in JPEG 2000 image processing that enables local attackers to execute arbitrary code when processing malicious image files. Organizations using these versions for image processing workflows face direct code execution risk from untrusted image sources, requiring immediate patching to prevent potential system compromise.
Apply vendor patch. Interim mitigations: restrict JPEG 2000 image processing to trusted/validated sources only; implement file source validation before passing to OpenImageIO; disable USE_OPENJPH compilation flag if JPEG 2000 support is not operationally required; run image processing in sandboxed environments with restricted privileges.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Exploit-DB