Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113681OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

Medium 5.5

In plain English

A medium-severity integer overflow in OpenImageIO from AcademySoftwareFoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openimageiono fix listedDEBIAN-CVE-2026-113681
Debian:13openimageiono fix listedDEBIAN-CVE-2026-113681
Debian:14openimageiono fix listedDEBIAN-CVE-2026-113681
Ubuntu:22.04:LTSopenimageiono fix listedUBUNTU-CVE-2026-113681
Ubuntu:26.10openimageiono fix listedUBUNTU-CVE-2026-113681

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation OpenImageIO 0 – before 3.0.20.03.1.0.0 – before 3.1.15.03.2.0.0-dev – before 3.2.0.3-beta1

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References