Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-50291OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)

Medium 5.5

In plain English

A medium-severity out-of-bounds read in OpenImageIO from AcademySoftwareFoundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in src/bmp.imageio/bmpinput.cpp with an empty color table. BmpInput::read_native_scanline then performs an invalid palette read while decoding an RLE-compressed scanline, causing a process crash and denial of service. This issue is fixed in versions 3.0.16.0 and 3.1.11.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12openimageiono fix listedDEBIAN-CVE-2026-50291
Debian:13openimageiono fix listedDEBIAN-CVE-2026-50291
Debian:14openimageio3.1.18.0+dfsg-2DEBIAN-CVE-2026-50291
Ubuntu:22.04:LTSopenimageiono fix listedUBUNTU-CVE-2026-50291
Ubuntu:26.10openimageiono fix listedUBUNTU-CVE-2026-50291

Affected products (as reported)

VendorProductVersions
AcademySoftwareFoundation OpenImageIO < 3.0.16.0>= 3.1.0.0, < 3.1.11.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References