CVE-2026-113681: OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected OpenImageIO versions are exposed when they process Cineon files supplied by an attacker. Exploitation requires local access and user interaction, such as opening or importing the crafted file.
What does an attacker need to provide?
The attacker needs a crafted Cineon file with a very large declared image width. That width can overflow the scanline-buffer size calculation and cause the reader to access memory beyond a 4-byte heap buffer.
What is the practical impact?
The described outcome is an application crash caused by a heap out-of-bounds read. The available data does not establish confidentiality or integrity impact.
Which versions should be updated?
Update OpenImageIO to 3.0.20.0 or later for the 3.0 branch, 3.1.15.0 or later for the 3.1 branch, or 3.2.0.3-beta1 or later for the 3.2 branch.