OpenImageIO EUVD-2026-30410

Requires victim to process a specially crafted DPX image file through an application using vulnerable OpenImageIO versions (3.0.x before 3.0.18.0 or 3.1.x before 3.1.13.0). The DPX file must specify pixel dimensions exceeding the integer overflow threshold (approximately 536 million pixels for kABGR descriptor or 715 million for kCbYCr descriptor based on the -4 and -3 multipliers respectively) while maintaining valid file structure to pass initial parsing. User interaction required - exploitation fails if file is not opened or processed by affected application. Attack complexity is low once crafted file is created, as no race conditions or non-default configurations are required. Exploitation effectiveness depends on heap memory layout and presence of modern exploit mitigations (ASLR, heap integrity checks); code execution may be unreliable on hardened systems but denial of service remains achievable.

Real-world risk is moderate-high despite the 8.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-reachable attack surface with low complexity, but mandatory user interaction (opening a malicious DPX file) significantly constrains automated exploitation. The vulnerability requires the attacker to deliver a crafted DPX file and convince a victim to process it through an OpenImageIO-based application - classic file format attack vector common in targeted attacks against media production environments. EPSS data not provided, but the combination of detailed public technical disclosure (GitHub Security Advisory GHSA-cq46-hp4h-cvfr) and straightforward exploitation logic suggests proof-of-concept development is feasible. No CISA KEV listing indicates no confirmed widespread or targeted exploitation. Technical impact is severe (heap corruption enabling potential code execution), but the UI:R constraint prevents wormable or automated mass exploitation. Priority for organizations using OpenImageIO in production pipelines (rendering farms, asset processing systems, media workflows) where malicious files could be introduced via file shares, email attachments, or third-party content. Lower priority for isolated systems or environments with strict file provenance controls.

An attacker crafts a DPX image file with metadata specifying an extremely large pixel count (over 536 million pixels for ABGR format) that triggers signed integer overflow during buffer size calculation. The attacker delivers this file to a victim via email attachment, cloud storage share, or compromised content delivery network. When the victim opens the file in a visual effects application using vulnerable OpenImageIO (e.g., rendering software, image viewer, asset converter), the undersized heap buffer allocation occurs, followed by heap corruption when full image data is written. Depending on heap layout and memory protections, the attacker may achieve denial of service (application crash) or escalate to arbitrary code execution by corrupting adjacent heap structures.