CVE-2026-7582

MEDIUM

AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write

Title source: cna
STIX 2.1

Description

A vulnerability was detected in AcademySoftwareFoundation OpenImageIO up to 3.2.0.1-dev. This vulnerability affects unknown code of the file src/dds.imageio/ddsinput.cpp of the component DDS Image Handler. The manipulation results in out-of-bounds write. The attack needs to be approached locally. The exploit is now public and may be used. The patch is identified as 94ec2deec3e3bf2f2e2ff84d008e27425d626fe2. Applying a patch is advised to resolve this issue.

References (7)

Core 7
Core References
Vdb Entry vdb-entry
VDB-360529 | AcademySoftwareFoundation OpenImageIO DDS Image ddsinput.cpp out-of-bounds write
https://vuldb.com/vuln/360529
Signature, Permissions Required signature permissions-required
VDB-360529 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/360529/cti
Third Party Advisory third-party-advisory
Submit #803548 | AcademySoftwareFoundation OpenImageIO 3.2.0.1-dev Out-of-bounds Write
https://vuldb.com/submit/803548

Scores

CVSS v3 5.3
EPSS 0.0011
EPSS Percentile 1.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-787
Status published
Products (1)
AcademySoftwareFoundation/OpenImageIO 3.2.0.1-dev
Published May 01, 2026
Tracked Since May 01, 2026