EUVD-2026-83122Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Local crafted-file trigger with required interaction (AV:L/UI:R), no auth (PR:N); out-of-bounds pointer writes give limited integrity impact (I:L) and reliable crash (A:H), no confidentiality (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open() uses that unchecked value as the loop bound while filling the fixed strings[8] array, writing pointers beyond the stack buffer and into adjacent state, resulting in memory corruption and denial of service. The affected implementation is identified by src/cineon.imageio/cineoninput.cpp, CineonInput::open(), numberOfElements, and strings[8], which define the relevant source path, functions, state, and trigger. This issue is fixed in versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1.
AnalysisAI
Stack-based buffer overflow in OpenImageIO's Cineon image reader (CineonInput::open()) lets a crafted .cin file that declares more than the format's maximum of eight channels overwrite stack pointers and corrupt adjacent memory, crashing the application that processes it. Exploitation requires the victim or an automated pipeline to open the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, 6.1), so it cannot be triggered remotely without inducing file ingestion; the assessed impact is denial of service with only low integrity risk and no confidentiality loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim (or an automated pipeline) to open or process a crafted Cineon .cin file whose header field numberOfElements exceeds the format maximum of 8, using an application linked against OpenImageIO prior to 3.0.20.0 / 3.1.15.0 / 3.2.0.3-beta1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but non-urgent memory-corruption flaw in OpenImageIO's Cineon reader. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade OpenImageIO to 3.0.20.0, 3.1.15.0, or 3.2.0.3-beta1 (or later) as described in advisory https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-xh8r-vmqq-56pp; the fix is in PR https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5250 / commit 908f22f5528e88e5e96184c194caa26b54b2b85f and adds header validation (channel count 1-8, bit depth 1-32). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openimageio
View allBuffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and caus
A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.
An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Proje
A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. Ra
A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branc
A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. Rated
A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today