CVE-2026-43904: OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width
Last updated 18 June 2026
Other sources
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE) and :345 (pure RLE) do not clamp the run length to remaining scanline width before writing pixels. The raw packet path (line 403) correctly clamps with std::min, but RLE paths skip this check. A crafted .pic file causes heap overflow up to 65535 bytes. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.0.18.0 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.1.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43904?
CVE-2026-43904 is classified as a heap buffer overflow vulnerability which can lead to potential remote code execution.
How do I fix CVE-2026-43904?
To mitigate CVE-2026-43904, update OpenImageIO to version 3.0.18.0 or 3.1.13.0 or later.
Which versions of OpenImageIO are affected by CVE-2026-43904?
CVE-2026-43904 affects OpenImageIO versions prior to 3.0.18.0 and between 3.1.4.0 and 3.1.13.0.
What types of attacks exploit CVE-2026-43904?
CVE-2026-43904 can be exploited through crafted image files that trigger the heap buffer overflow, leading to unpredictable behavior.
Is there a workaround for CVE-2026-43904 if I cannot update OpenImageIO?
There is no known workaround for CVE-2026-43904; the best practice is to apply the recommended updates.