Out-of-Bounds Write Vulnerability in OpenImageIO by Academy Software Foundation
CVE-2026-7582

4.8MEDIUM

Key Information:

Vendor

Academysoftwarefoundation

Status
Openimageio
Vendor
CVE Published:
1 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7582?

A vulnerability has been identified in the Academy Software Foundation's OpenImageIO, specifically within the DDS Image Handler component. This issue arises from an out-of-bounds write condition found in the src/dds.imageio/ddsinput.cpp file. Successful exploitation requires local access, and the attack vector has already been made public. Users are strongly urged to apply the provided patch (commit 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2) to mitigate the risks associated with this vulnerability.

Affected Version(s)

OpenImageIO 3.2.0.1-dev

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7582 - Proof of Concept

References

https://vuldb.com/vuln/360529
vdb-entry
https://vuldb.com/vuln/360529/cti
signaturepermissions-required
https://vuldb.com/submit/803548
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

biniam (VulDB User)
.