Vulnerabilities

TI-2026-76948 CVE-2026-113681 · GHSA-pxpf-24pm-xj4x

Heap out-of-bounds read in OpenImageIO Cineon reader

LOW 29

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00165 Published 2026-10-20 Fixed in 3.0.20.0, 3.1.15.0 +1 CWE-190

TI-2026-42768 CVE-2026-59981

OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00317 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-125

TI-2026-48280 CVE-2026-68514

OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images

MEDIUM 58

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00184 Published 2026-08-25 Fixed in 3.3.13, 3.4.14 CWE-122

TI-2026-48281 CVE-2026-68515

OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00191 Published 2026-08-25 Partial fix · 3.3.13, 3.4.14 +1 CWE-122

TI-2026-48279 CVE-2026-68513

OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00194 Published 2026-08-25 Fixed in 3.3.13, 3.4.14 CWE-122

TI-2026-46992 CVE-2026-65979

OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)

MEDIUM 63

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 4.0MEDIUM 6.7 Local No auth User interaction EPSS 0.0018 Published 2026-08-25 Fixed in 3.4.13 CWE-125

TI-2026-44990 CVE-2026-62986

OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

LOW 20

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0038 Published 2026-08-25 Fixed in 3.3.13, 3.4.14 CWE-200

TI-2026-44109 CVE-2026-61555

OpenEXR: Empty multiView viewFromChannelName file crash

LOW 24

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00172 Published 2026-08-25 Partial fix · 3.2.11, 3.3.13 +1 CWE-125

TI-2026-42772 CVE-2026-59985

OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32

MEDIUM 58

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00172 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-125

TI-2026-42771 CVE-2026-59984

OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32

MEDIUM 58

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00172 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-787

TI-2026-42770 CVE-2026-59983

OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32

MEDIUM 58

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00172 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-125

TI-2026-42769 CVE-2026-59982

OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms

LOW 31

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00314 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-190

TI-2026-42338 CVE-2026-59189

OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow origin

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0031 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-125

TI-2026-42337 CVE-2026-59187

OpenEXR: exrmetrics deep pixelmode heap buffer overflow

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00402 Published 2026-08-25 Fixed in 3.3.13, 3.4.14 CWE-122

TI-2026-42336 CVE-2026-59186

OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds

MEDIUM 64

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00272 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-122

TI-2026-42335 CVE-2026-59184

OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

LOW 31

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00218 Published 2026-08-25 Fixed in 3.2.11, 3.3.13 +1 CWE-416

TI-2026-42334 CVE-2026-59183

OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding

LOW 24

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00172 Published 2026-08-25 Partial fix · 3.2.11, 3.3.13 +1 CWE-190

TI-2026-39952 CVE-2026-55373

OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts

MEDIUM 61

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 6.2 Local No auth No interaction EPSS 0.00157 Published 2026-08-25 Partial fix · 3.2.10, 3.3.12 +1 CWE-190

TI-2026-39951 CVE-2026-55371

OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length

LOW 30

OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00167 Published 2026-08-25 Fixed in 3.4.13 CWE-20

TI-2026-39766 CVE-2026-55059

OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability

MEDIUM 60

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.00148 Published 2026-08-25 Partial fix · 3.2.10, 3.3.12 +1 CWE-787

TI-2026-39689 CVE-2026-54920

OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resize

MEDIUM 42

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1N/A 0.0 Network No auth No interaction EPSS 0.00356 Published 2026-08-25 Fixed in 3.2.10 CWE-190

TI-2026-38605 CVE-2026-53532

OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS)

HIGH 70

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00445 Published 2026-08-24 Fixed in 3.4.13 CWE-617

TI-2026-48282 CVE-2026-68516

OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow

MEDIUM 62

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00452 Published 2026-08-24 Fixed in 3.4.14 CWE-121

TI-2026-30739 CVE-2026-42450

OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser

HIGH 72

OpenColorIO is a color management framework for visual effects and animation.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00182 Published 2026-06-24 Fixed in 2.5.2 CWE-120

TI-2026-06665 CVE-2026-7582 · GHSA-8rf3-pw76-xgwv

AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write

MEDIUM 55

A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00112 Published 2026-05-01 No fix listed CWE-119

Vulnerabilities

Filters