CVE-2026-43905: OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes buffer size as const int bufsize = w h ch bufferbpp using signed 32-bit arithmetic. When the product exceeds INTMAX, the result wraps to 0 or a small value. mbuf.resize() allocates an undersized buffer, and subsequent pixel write loops cause heap overflow. Conditional on USEOPENJPH build flag. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43905?
CVE-2026-43905 is categorized as a high severity vulnerability due to the potential for a signed integer overflow affecting buffer allocation.
How do I fix CVE-2026-43905?
To mitigate CVE-2026-43905, update OpenImageIO to version 3.0.18.0 or 3.1.13.0 or later.
What systems are affected by CVE-2026-43905?
CVE-2026-43905 affects OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0.
What type of vulnerability is CVE-2026-43905?
CVE-2026-43905 is a buffer allocation vulnerability caused by a signed integer overflow in the JPEG2000 processing code.
What can an attacker achieve with CVE-2026-43905?
An attacker exploiting CVE-2026-43905 may cause denial of service or execute arbitrary code due to buffer overflow conditions.