Log in Start free

Vulnerability · Published Jan 11, 2026 · Assigned by VulDB

CVE-2025-15506AcademySoftwareFoundation OpenColorIO FileRules.cpp ConvertToRegularExpression out-of-bounds

Low 3.3

In plain English

A low-severity out-of-bounds read in OpenColorIO from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/OpenColorIO/FileRules.cpp. Performing a manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is named ebdbb75123c9d5f4643e041314e2bc988a13f20d. To fix this issue, it is recommended to deploy a patch. The fix was added to the 2.5.1 milestone.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12opencoloriono fix listedDEBIAN-CVE-2025-15506
Debian:13opencoloriono fix listedDEBIAN-CVE-2025-15506
Debian:14opencoloriono fix listedDEBIAN-CVE-2025-15506
PyPIopencolorio2.5.1GHSA-m86r-wr74-693h
PyPIopencolorio2.5.1PYSEC-2026-1745
Ubuntu:22.04:LTSopencoloriono fix listedUBUNTU-CVE-2025-15506
Ubuntu:24.04:LTSopencoloriono fix listedUBUNTU-CVE-2025-15506
Ubuntu:25.10opencoloriono fix listedUBUNTU-CVE-2025-15506
Ubuntu:26.04:LTSopencoloriono fix listedUBUNTU-CVE-2025-15506
Ubuntu:26.10opencoloriono fix listedUBUNTU-CVE-2025-15506

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation OpenColorIO 2.02.12.22.32.42.5.0

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References