OP
Product
OpenImageIO
21
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 11Medium 10Low 0
Watch
Add OpenImageIO to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-43908 | 8.8 | May 14 | OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-43909 | 8.8 | May 14 | OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-63638 | 8.3 | Sep 18 | OpenImageIO: Cineon invalid bit depth heap out-of-bounds write Affected: < 3.0.21.0; >= 3.1.0.0, < 3.1.16.0; >= 3.2.0.0-dev, < 3.2.0.3-beta1 |
| CVE-2026-43907 | 8.3 | May 14 | OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR) Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-63419 | 7.8 | Sep 18 | OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer Affected: < 3.0.21.0; >= 3.1.0.0, < 3.1.16.0; >= 3.2.0.0-dev, < 3.2.0.3-beta1 |
| CVE-2026-63422 | 7.8 | Sep 18 | OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write Affected: < 3.0.21.0; >= 3.1.0.0, < 3.1.16.0; >= 3.2.0.0-dev, < 3.2.0.3-beta1 |
| CVE-2026-43903 | 7.8 | May 14 | OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-43904 | 7.8 | May 14 | OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-43905 | 7.8 | May 14 | OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-43906 | 7.8 | May 14 | OpenImageIO: HEIF Heap overflow Affected: < 3.0.18.0; >= 3.1.4.0-beta, < 3.1.13.0 |
| CVE-2026-67549 | 7.6 | Sep 18 | OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write Affected: < 3.1.16.0 |
Showing 11
