Memory Corruption Vulnerability in OpenImageIO Affects Multiple Versions
CVE-2026-59181
What is CVE-2026-59181?
OpenImageIO, a widely used toolkit for handling a variety of image file formats in VFX and animation, is susceptible to a memory corruption vulnerability. When processing a specially crafted cineon file, the application allows an unchecked value for the number of elements that exceeds the specified maximum. This flaw occurs in the cineoninput::open() function, which uses the invalid value as a loop boundary, leading to buffer overflow. Consequently, this can corrupt adjacent memory space, causing potential application instability and denial of service. The issue has been addressed in the updated versions 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, emphasizing the importance of upgrading to these releases to safeguard against exploitation.
Affected Version(s)
OpenImageIO < 3.0.20.0 < 3.0.20.0
OpenImageIO >= 3.1.0.0, < 3.1.15.0 < 3.1.0.0, 3.1.15.0
OpenImageIO >= 3.2.0.0-dev, < 3.2.0.3-beta1 < 3.2.0.0-dev, 3.2.0.3-beta1