CVE-2026-43906: OpenImageIO: HEIF Heap overflow
Last updated 18 June 2026
Other sources
OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted images due to a subimage metadata mismatch, leading to memory corruption and potential code execution. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.0.18.0 - Upgrade
Upgrade
debian/openimageioto a version that resolves this vulnerability.Fixed in 3.1.13.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43906?
CVE-2026-43906 is classified as a medium severity vulnerability due to the potential for a heap overflow.
How do I fix CVE-2026-43906?
To mitigate CVE-2026-43906, upgrade OpenImageIO to version 3.0.18.0 or 3.1.13.0 or later.
What causes CVE-2026-43906 vulnerability?
CVE-2026-43906 is caused by a heap-based buffer overflow in the HEIF decoder of OpenImageIO.
Which versions of OpenImageIO are affected by CVE-2026-43906?
OpenImageIO versions prior to 3.0.18.0 and 3.1.13.0 are affected by CVE-2026-43906.
Are there any workarounds for CVE-2026-43906?
Disabling HEIF decoding can serve as a temporary workaround for CVE-2026-43906 until a version upgrade is feasible.