EUVD-2026-83121Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Crafted file processed by a networked consumer (AV:N) with no auth (PR:N) but requiring the victim to open it (UI:R); unbounded recursion yields a process crash - availability-only (A:H, C/I:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted fits stream containing consecutive 2880-byte header blocks without the mandatory end keyword makes fitsinput::read_fits_header() call itself without a depth bound. repeated recursive parsing exhausts the application stack, resulting in denial of service. The affected implementation is identified by src/fits.imageio/fitsinput.cpp, FitsInput::read_fits_header(), END keyword, and 2880-byte FITS header blocks, which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
AnalysisAI
Stack exhaustion in OpenImageIO's FITS image reader (all releases prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1) lets a crafted FITS stream crash a parsing process by driving FitsInput::read_fits_header() into unbounded recursion. The trigger is a stream of consecutive 2880-byte header blocks that never contain the mandatory END keyword, so each block causes another self-call until the application stack is consumed; remote, unauthenticated attackers can deliver the payload but successful exploitation requires the victim to open or ingest the file (UI:R), and the resulting impact is availability-only with no code execution or data disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a target application or service using OpenImageIO (prior to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1) reads/parses an attacker-supplied FITS-format file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but bounded-severity denial-of-service issue, not a high-priority remote-code-execution threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a vendor-fixed release: 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1, which replace the recursive header parse with an iterative loop capped at 10,000 header blocks (upstream fix in PR #5248, commit b0de7d40d06eb4abc7ef14c1321a1a2a976d8c1c; advisory GHSA-xvwr-x6ch-v2fq). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today