CVE-2026-43906
Full vulnerability record from the local CVENow database.
Description
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
Severity
HIGH
CVSS score
8.5
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-14 20:17:06.607000
Last modified
2026-10-26 14:10:00.130000
View original CVE JSON
{
"id": "CVE-2026-43906",
"sourceIdentifier": "[email protected]",
"published": "2026-05-14T20:17:06.607",
"lastModified": "2026-10-26T14:10:00.130",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0."
},
{
"lang": "es",
"value": "OpenImageIO es un conjunto de herramientas para leer, escribir y manipular archivos de imagen de cualquier formato de archivo de imagen relevante para VFX / animación. Antes de 3.0.18.0 y 3.1.13.0, un desbordamiento de búfer basado en montículo en el decodificador HEIF de OpenImageIO permite escrituras fuera de límites a través de imágenes manipuladas debido a una falta de coincidencia de metadatos de subimagen, lo que lleva a corrupción de memoria y potencial ejecución de código. Esta vulnerabilidad está corregida en 3.0.18.0 y 3.1.13.0."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "AcademySoftwareFoundation",
"product": "OpenImageIO",
"versions": [
{
"version": "< 3.0.18.0",
"status": "affected"
},
{
"version": ">= 3.1.4.0-beta, < 3.1.13.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-15T14:36:23.335262Z",
"id": "CVE-2026-43906",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.18.0",
"matchCriteriaId": "90B206C1-E7DB-4175-8077-C76D5C8533AF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openimageio:openimageio:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.1.4.0",
"versionEndExcluding": "3.1.13.0",
"matchCriteriaId": "34BBB27F-256F-4D15-A394-158343CB8B4D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openimageio:openimageio:3.2.0.2:dev:*:*:*:*:*:*",
"matchCriteriaId": "450296D8-74F5-4847-8433-FE3DFB16C58E"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-gmrp-x952-3m66",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
]
}
]
}