Which versions of OpenColorIO are affected by EUVD-2026-38769?

OpenColorIO, which manages color processing in media production and visualization applications across the organization, can be exploited through specially crafted color files to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-38769?

Within 24 hours: Identify all systems running OpenColorIO prior to version 2.5.2 and restrict user ability to load color lookup files from untrusted sources. Within 7 days: Implement whitelist controls for .spi3d, .spi1d, .cube, and .lut file origins, disable external file uploads, and add source validation at the application level. Within 30 days: Monitor OpenColorIO project releases for patch availability, conduct security testing in staged environments, and execute controlled production deployment.

OpenColorIO EUVD-2026-38769

Q: What is the CVSS score of EUVD-2026-38769?

EUVD-2026-38769 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-42450 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-24 GitHub_M

Buffer Overflow Microsoft Suse Opencolorio Academysoftwarefoundation

8.4

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

File-parsing flaw triggered by opening a crafted LUT, so AV:L and UI:R with PR:N; the stack overflow can yield full local process compromise, giving C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 15:02 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 14:20 vuln.today

Analysis Generated

Jun 24, 2026 - 14:20 vuln.today

CVE Published

Jun 24, 2026 - 13:20 cve.org

HIGH 8.4

DescriptionCVE.org

OpenColorIO is a color management framework for visual effects and animation. Prior to version 2.5.2, FileFormatSpi3D.cpp:163 uses sscanf with %s into 64-byte stack buffers when parsing LUT data lines. Input comes from lineBuffer[4096], so a crafted .spi3d file can overflow by ~4000 bytes on non-Windows. Version 2.5.2 fixes the issue.

AnalysisAI

Stack buffer overflow in OpenColorIO's .spi3d LUT parser allows a crafted color-lookup file to corrupt memory in any application that loads it. The flaw in FileFormatSpi3D.cpp reads attacker-controlled data from a 4096-byte line into 64-byte stack buffers via unbounded sscanf %s, permitting an overflow of roughly 4000 bytes on non-Windows platforms. It affects all OCIO 1.x and 2.x releases prior to 2.5.2 and, while no public exploit has been identified, the same unsafe pattern was found across the .spi3d, .spi1d, .cube, and .lut parsers.

Technical ContextAI

OpenColorIO (OCIO) is the de facto color-management framework for visual effects and animation, embedded in DCC applications such as Maya, Nuke, Blender, and many renderers, where it loads LUT (look-up table) files to transform color data. The root cause is CWE-120 (classic buffer overflow / improper restriction of operations within memory buffer bounds): at FileFormatSpi3D.cpp:163 the parser uses sscanf with an unbounded %s conversion to read tokens from a 4096-byte lineBuffer into fixed 64-byte stack arrays, so no length check constrains the copy. The CPE cpe:2.3:a:academysoftwarefoundation:opencolorio:*:*:* confirms the affected component is the OCIO library itself rather than any single host application, meaning every product statically or dynamically linking a vulnerable OCIO version inherits the flaw.

RemediationAI

Vendor-released patch: OpenColorIO 2.5.2, which is ABI compatible with 2.5.1 and fixes the issue via PR #2307 ('Improve LUT loading checks'); upgrade to v2.5.2 or rebuild/relink any application that embeds OCIO against this version (https://github.com/AcademySoftwareFoundation/OpenColorIO/releases/tag/v2.5.2, advisory GHSA-rxp3-rrgx-f547). Note that the same PR also remediates three sibling advisories (GHSA-66xr-9rgw-v6m8, GHSA-28jr-x9w2-5pc4, GHSA-fgx7-35rr-5mx2) covering the .spi1d, .cube, and .lut parsers, so partial fixes are not advisable. Where immediate upgrade is impractical, restrict ingestion of untrusted LUT files: only load .spi3d/.spi1d/.cube/.lut assets from trusted sources, validate or sandbox LUT-parsing steps in automated pipelines, and treat externally supplied color assets as untrusted input - the trade-off is added friction in asset-sharing workflows but it directly removes the attacker-controlled-file delivery path.