Buffer Overflow Vulnerability in OpenImageIO Toolset

CVE-2026-43996

What is CVE-2026-43996?

OpenImageIO, a toolset designed for reading, writing, and manipulating image files relevant to visual effects and animation, contains a buffer overflow vulnerability in its TGAInput::decode_pixel function. When specific conditions are met, particularly when k equals 0xFFFFFFFC and palbytespp is set to 4, an arithmetic overflow can occur. This situation leads to an invalid memory access, allowing code execution beyond the allocated buffer, resulting in potential application crashes or malicious exploitation. The issue has been addressed in versions 3.0.18.0 and 3.1.13.0.

References