Denial of Service Vulnerability in OpenImageIO by Academy Software Foundation
CVE-2026-59156
6.5MEDIUM
What is CVE-2026-59156?
A vulnerability in OpenImageIO allows for denial of service due to improper handling of crafted FITS streams. Specifically, a sequence of 2880-byte header blocks lacking the required 'END' keyword causes the function fitsinput::read_fits_header() to enter an uncontrolled recursive state, leading to stack exhaustion. This flaw impacts versions prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1 and has been addressed in subsequent updates.
Affected Version(s)
OpenImageIO < 3.0.20.0 < 3.0.20.0
OpenImageIO >= 3.1.0.0, < 3.1.15.0 < 3.1.0.0, 3.1.15.0
OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1 < 3.2.0.0-dev, 3.2.0.3-beta1