CVE-2026-43904
HIGHOpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width
Title source: cnaDescription
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-4499-j545-7q33
Scores
CVSS v3
7.8
EPSS
0.0017
EPSS Percentile
7.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-787
Status
published
Products (3)
AcademySoftwareFoundation/OpenImageIO
< 3.0.18.0
AcademySoftwareFoundation/OpenImageIO
>= 3.1.4.0-beta, < 3.1.13.0
openimageio/openimageio
< 3.0.18.0
Published
May 14, 2026
Tracked Since
May 15, 2026