Denial of Service Vulnerability in OpenImageIO BMP File Handling
CVE-2026-50291
5.5MEDIUM
What is CVE-2026-50291?
OpenImageIO, a versatile toolset for handling image files across various formats used in VFX and animation, is susceptible to a denial of service vulnerability. This issue arises when specially crafted BMP files are processed via oiiotool or applications linked to OpenImageIO, which can trigger a crash due to improper palette handling in the BMP processing components. Specifically, the problem occurs when an empty color table is encountered, leading to an invalid read during the decoding of RLE-compressed scanlines. Users are advised to upgrade to the fixed versions 3.0.16.0 and 3.1.11.0 to mitigate this issue.
Affected Version(s)
OpenImageIO < 3.0.16.0 < 3.0.16.0
OpenImageIO >= 3.1.0.0, < 3.1.11.0 < 3.1.0.0, 3.1.11.0