EUVD-2026-82558Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attacker-supplied file processed locally (AV:L, UI:R), no authentication (PR:N), deterministic trigger (AC:L), and the only outcome is a process crash (C:N/I:N/A:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.
AnalysisAI
An out-of-bounds read in OpenImageIO's BMP reader allows a crafted palette BMP to crash any process that decodes it, causing denial of service. Affected are versions prior to 3.0.16.0 and 3.1.11.0: a malformed file whose DIB header sets the palette flag but supplies an empty color table, combined with RLE4 or RLE8 compression, drives BmpInput::read_native_scanline into an invalid palette lookup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to process an attacker-controlled crafted BMP file through oiiotool or an application linked to OpenImageIO (versions before 3.0.16.0 / 3.1.11.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate priority availability-only issue, correctly rated at CVSS 5.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to OpenImageIO 3.0.16.0 or 3.1.11.0 (release tags v3.0.16.0 and v3.1.11.0), which incorporate the guards added in commits 91500ed58ce927b7e710c6bbc3b7f795bb0791b5, be984856e315e0a82cd866745b544c8c4cb8bd45 and ee3370d004d5895554239b4302c59eedb721f086 via PR 5030 and documented in advisory https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-q3c7-3225-66h7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today