OpenImageIO EUVD-2026-83122

Requires the victim (or an automated pipeline) to open or process a crafted Cineon .cin file whose header field numberOfElements exceeds the format maximum of 8, using an application linked against OpenImageIO prior to 3.0.20.0 / 3.1.15.0 / 3.2.0.3-beta1. This affects default configurations of the Cineon reader - no special feature toggle is needed - but exploitation is limited by the local attack vector (AV:L) and mandatory user interaction/file handling (UI:R): the attacker cannot trigger it remotely without inducing the target to ingest the malicious image. Practical impact is a crash of the processing application; broader consequences depend on how the corrupted stack pointers are subsequently used.

This is a genuine but non-urgent memory-corruption flaw in OpenImageIO's Cineon reader. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H = 6.1) is internally consistent and I agree with it: exploitation is local and requires the victim to open or process an attacker-supplied .cin file (UI:R), with the dominant impact being a crash/DoS (A:H) and limited integrity impact (I:L) from the out-of-bounds pointer writes. No EPSS score, no CISA KEV listing, and no public exploit code were provided; the only 'proof' artifact is a regression test input (broken_bitdepth.cin) added alongside the fix, which is a defensive test file, not a weaponized exploit - so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. Notably, the description states the bug writes attacker-influenced pointers 'beyond the stack buffer and into adjacent state,' which is a hallmark of a potentially more-than-DoS condition (possible control-flow corruption), yet the vendor conservatively scored confidentiality N and integrity only L; defenders processing untrusted images at scale should treat the I:L rating as a possible under-statement while accepting that the practical, reliable outcome is a crash. Overall: a real bug worth patching in image pipelines but not a drop-everything network-exploitable issue.

An attacker crafts a malicious Cineon (.cin) image whose header sets numberOfElements to a value greater than 8 (the test uses 255) and delivers it to a victim who renders, converts, or thumbnails it with an application built on OpenImageIO. When CineonInput::open() loops on the unchecked count to fill the fixed strings[8] stack array, it writes pointers past the buffer into adjacent stack state, corrupting memory and crashing the process. No public exploit exists beyond the vendor's regression test file; exploitation requires local file processing and user/pipeline interaction (UI:R).