Integer Overflow in Cineon Codec of OpenImageIO Software

CVE-2026-113681

What is CVE-2026-113681?

OpenImageIO versions prior to 3.0.20.0, along with 3.1.x before 3.1.15.0, and 3.2.x prior to 3.2.0.3-beta1, expose a vulnerability due to an integer overflow in cineon::Codec::Read. This leads to an undersized scanline buffer, enabling attackers to create specially crafted Cineon files with large declared widths. Such manipulation can cause the size calculation of the buffer to wrap to zero, leading to heap out-of-bounds reads during processing. This vulnerability can potentially crash the application and compromise system integrity.

References